CVEs-PoC/2019/CVE-2019-10778.md

CVE-2019-10778

Description

devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable commonName controlled by user input is used as part of the exec function without any sanitization.

POC

Reference

• https://snyk.io/vuln/SNYK-JS-DEVCERTSANSCACHE-540926

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/ossf-cve-benchmark/CVE-2019-10778