CVE-2020-28429 Scanner
CVE-2020-28429 Scanner - Command Injection vulnerability in geojson2kml
Short Info
Level
Critical
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
25 days 10 hours
Scan only one
Domain, IPv4
Toolbox
-
The geojson2kml software is a tool used for converting GeoJSON files into KML (Keyhole Markup Language) format. It is often used by developers and geospatial analysts who need to transfer spatial data between different applications that support these file formats. This tool is particularly beneficial in the fields of GIS (Geographical Information Systems) and web development where map data needs to be displayed. By facilitating the conversion of data formats, geojson2kml aids in seamless data integration across platforms. The software's functionality has made it popular among professionals who manage and visualize large geographical datasets.
A Command Injection vulnerability exists when user-controlled input is not properly sanitized before being executed by the system. This type of vulnerability can allow attackers to execute arbitrary commands on the host operating system via a vulnerable application. In the case of geojson2kml, the command injection vulnerability could be exploited by malicious actors to gain unauthorized access or execute arbitrary commands. The exploitation of such vulnerabilities often occurs due to a lack of input validation and improper handling of special characters in the user input.
Technical details of the vulnerability in geojson2kml indicate that the problem lies in how the software processes user input. The vulnerable endpoint is "/convert" where user-supplied data is included in command execution without proper sanitization. The vulnerable parameter in this case is "fileName", which when manipulated, can lead to command execution. The unchecked input allows attackers to append additional commands effectively controlling the behavior of the application and underlying system.
Exploitation of the command injection vulnerability in geojson2kml can lead to serious consequences. Malicious attackers could execute commands to view, modify, or delete data, potentially causing data loss or corruption. They might also gain elevated privileges, enabling further exploration and compromise of the networked system. Beyond data manipulation, attackers could install malware, use the compromised system as a launching point for further attacks, or disrupt service availability leading to Denial of Service (DoS).
REFERENCES
