CVE-2019-19609
Summary
| CVE | CVE-2019-19609 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-12-05 20:15:00 UTC |
| Updated | 2021-09-14 12:03:00 UTC |
| Description | The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function. |
Risk And Classification
Problem Types: CWE-78
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Strapi | Strapi | 3.0.0 | alpha10.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.1.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.7.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13.0.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.1.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.4.0 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha15 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha16 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha17 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha18 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha19 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha20 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha21 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha22 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha23 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha23.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha24 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha24.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha4.8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha5.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha5.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha7.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha7.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha8.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta0 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta10 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta11 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta12 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta13 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta14 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta15 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta9 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.1.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.7.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13.0.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.1.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.4.0 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha15 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha16 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha17 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha18 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha19 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha20 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha21 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha22 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha23 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha23.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha24 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha24.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha4.8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha5.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha5.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha7.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha7.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha8.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta0 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta10 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta11 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta12 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta13 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta14 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta15 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta9 | All | All |
| Application | Strapi | Strapi | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Validate plugin name by alexandrebodin · Pull Request #4636 · strapi/strapi · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Strapi Framework Vulnerable to Remote Code Execution (CVE-2019-19609) :: { bit.therapy } | MISC | bittherapy.net | Exploit, Third Party Advisory |
| Strapi 3.0.0-beta.17.7 Remote Code Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Strapi CMS 3.0.0-beta.17.4 Remote Code Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.