CVE-2020-15227: Nette/application Remote Code Execution Vulnerability
HIGHCVE-2020-15227 is a HIGH (CVSS 8.7) remote code execution vulnerability (CWE-94: Improper Control of Generation of Code ('Code Injection')) affecting Nette/application libraries in the Packagist ecosystem. The issue involves potential remote code execution vulnerability. Remediation is available by upgrading affected packages to version 2.2.10, 2.3.14, 2.4.16, 3.0.6, 2.0.19, 2.1.13.
CVE-2020-15227 at a Glance
Security Impact
CVSS: 8.7
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
How to Fix CVE-2020-15227
To remediate this vulnerability, upgrade all affected Nette/application dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade nette/application to 2.2.10Upgrade nette/application to 2.3.14Upgrade nette/application to 2.4.16Upgrade nette/application to 3.0.6Upgrade nette/application to 2.0.19Upgrade nette/application to 2.1.13Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for nette/applicationHow to Check if You Are Affected
To determine whether your application is affected by CVE-2020-15227, inspect your project dependencies for Nette/application:
inspect dependencies for nette/applicationAnalyze the terminal output to locate any version of Nette/application in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.2.10), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. In Nette/application, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2020-15227 Affected Nette/application Versions
6 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
nette/application
|
Packagist |
≥ 2.2.0
< 2.2.10
|
2.2.10
|
|
nette/application
|
Packagist |
≥ 2.3.0
< 2.3.14
|
2.3.14
|
|
nette/application
|
Packagist |
≥ 2.4.0
< 2.4.16
|
2.4.16
|
|
nette/application
|
Packagist |
≥ 3.0.0
< 3.0.6
|
3.0.6
|
|
nette/application
|
Packagist |
≥ 2.0.0
< 2.0.19
|
2.0.19
|
|
nette/application
|
Packagist |
≥ 2.1.0
< 2.1.13
|
2.1.13
|
References
Frequently Asked Questions
What is CVE-2020-15227?
Which Nette/application versions are affected?
What version fixes CVE-2020-15227?
Is nette/application affected?
What is the CVSS score of CVE-2020-15227?
What CWE is associated with CVE-2020-15227?
How can I check Packagist dependencies for CVE-2020-15227?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-8gv3-3j7f-wg94",
"modified" : "2021-11-19T15:12:40Z",
"published" : "2020-10-02T16:22:19Z",
"aliases" : [ "CVE-2020-15227" ],
"summary" : "Potential Remote Code Execution vulnerability",
"details" : "Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. \n\nReported by Cyku Hong from DEVCORE (https://devco.re)\n\n### Impact\nCode injection, possible remote code execution.\n\n### Patches\nFixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "nette/application"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.2.0"
}, {
"fixed" : "2.2.10"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "nette/application"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.3.0"
}, {
"fixed" : "2.3.14"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "nette/application"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.4.0"
}, {
"fixed" : "2.4.16"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "nette/application"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.0.0"
}, {
"fixed" : "3.0.6"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "nette/application"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.0.0"
}, {
"fixed" : "2.0.19"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Packagist",
"name" : "nette/application"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.1.0"
}, {
"fixed" : "2.1.13"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-15227"
}, {
"type" : "WEB",
"url" : "https://blog.nette.org/en/cve-2020-15227-potential-remote-code-execution-vulnerability"
}, {
"type" : "WEB",
"url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/nette/application/CVE-2020-15227.yaml"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/nette/application"
}, {
"type" : "WEB",
"url" : "https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html"
}, {
"type" : "WEB",
"url" : "https://packagist.org/packages/nette/application"
}, {
"type" : "WEB",
"url" : "https://packagist.org/packages/nette/nette"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-74", "CWE-94" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2020-10-01T19:00:48Z",
"nvd_published_at" : "2020-10-01T19:15:00Z"
}
}