CVE-2019-10777: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

February 14, 2020 (updated August 19, 2021)

In aws-lambda versions, the “config.FunctioName” is used to construct the argument used within the “exec” function without any sanitization. It is possible for a user to inject arbitrary commands to the “zipCmd” used within “config.FunctionName”.

References

github.com/advisories/GHSA-934x-72xh-5hrg
github.com/awspilot/cli-lambda-deploy
nvd.nist.gov/vuln/detail/CVE-2019-10777
snyk.io/vuln/SNYK-JS-AWSLAMBDA-540839

Code Behaviors & Features

Detect and mitigate CVE-2019-10777 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →