Splint3r7

Command Injection Vulnerability in Rising 1.0.2

Command injection vulnerability was identified in NPM package rising version 1.0.2

Resources:

• Project's NPM Package: https://www.npmjs.com/package/rising
• Project's NPM JS registery: https://registry.npmjs.org/rising

Code Analysis Background

Splint3r7

domain
123rf.com
1stdibs.com
2u.com
ba.com
babylist.com
bananatag.com
baylor.edu
bbcgoodfood.com
bcm.edu

Splint3r7

# this command will return instances where the child_process module is loaded.  
# that module is generally a good signal that the application is shelling out
egrep -r --exclude-dir "node_modules" --include "*.js" --exclude "*.min.*" -e "require(\s*)\((\s*)'child_process'(\s*))" .

# this command will return instances where code is dynamically executed.  
egrep -r --exclude-dir "node_modules" --include "*.js" --exclude "*.min.*" -e "eval(\s*)\(" .

# this command will check common dangerous functions and report when strings are arguments
egrep -r --exclude-dir "node_modules" --include "*.js" --exclude "*.min.*" -e "(setInterval|setTimeout|new(\s*)Function)(\s*)\((\s*)\".*\"" .