CVEs-PoC/2021/CVE-2021-23337.md

CVE-2021-23337

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

POC

Reference

• https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
• https://snyk.io/vuln/SNYK-JS-LODASH-1040724
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/HotDB-Community/HotDB-Engine
• https://github.com/LSEG-API-Samples/Example.EWA.TypeScript.WebApplication
• https://github.com/Refinitiv-API-Samples/Example.EWA.TypeScript.WebApplication
• https://github.com/andisfar/LaunchQtCreator
• https://github.com/anthonykirby/lora-packet
• https://github.com/cduplantis/blank
• https://github.com/marcosrg9/YouTubeTV
• https://github.com/p-rog/cve-analyser
• https://github.com/samoylenko/sample-vulnerable-app-nodejs-express
• https://github.com/samoylenko/vulnerable-app-nodejs-express
• https://github.com/seal-community/patches
• https://github.com/the-scan-project/tsp-vulnerable-app-nodejs-express
• https://github.com/the-scan-project/vulnerable-app-nodejs-express
• https://github.com/tomjfrog-org/frogbot-npm-demo
• https://github.com/tomjfrog/frogbot-demo