CVE-2021-23337

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS breakdown

Affected products

• lodash / lodash4.17.21
• NetApp / active_iq_unified_manager
• NetApp / active_iq_unified_manager
• NetApp / active_iq_unified_manager
• NetApp / cloud_manager
• NetApp / system_manager9.0 – 9.0
• oracle / banking_corporate_lending_process_management14.2.0 – 14.2.0
• oracle / banking_corporate_lending_process_management14.3.0 – 14.3.0
• oracle / banking_corporate_lending_process_management14.5.0 – 14.5.0
• oracle / banking_credit_facilities_process_management14.2.0 – 14.2.0
• oracle / banking_credit_facilities_process_management14.3.0 – 14.3.0
• oracle / banking_credit_facilities_process_management14.5.0 – 14.5.0
• oracle / banking_extensibility_workbench14.5.0 – 14.5.0
• oracle / banking_extensibility_workbench14.2.0 – 14.2.0
• oracle / banking_extensibility_workbench14.3.0 – 14.3.0
• oracle / banking_supply_chain_finance14.5.0 – 14.5.0
• oracle / banking_supply_chain_finance14.3.0 – 14.3.0
• oracle / banking_supply_chain_finance14.2.0 – 14.2.0
• oracle / banking_trade_finance_process_management14.3.0 – 14.3.0
• oracle / banking_trade_finance_process_management14.5.0 – 14.5.0
• oracle / banking_trade_finance_process_management14.2.0 – 14.2.0
• oracle / communications_cloud_native_core_binding_support_function1.9.0 – 1.9.0
• oracle / communications_cloud_native_core_policy1.11.0 – 1.11.0
• oracle / communications_design_studio7.4.2.0.0 – 7.4.2.0.0
• oracle / communications_services_gatekeeper7.0 – 7.0
• oracle / communications_session_border_controller9.0 – 9.0
• oracle / communications_session_border_controller8.4 – 8.4
• oracle / enterprise_communications_broker3.2.0 – 3.2.0
• oracle / enterprise_communications_broker3.3.0 – 3.3.0
• oracle / financial_services_crime_and_compliance_management_studio8.0.8.2.0 – 8.0.8.2.0
• oracle / financial_services_crime_and_compliance_management_studio8.0.8.3.0 – 8.0.8.3.0
• oracle / health_sciences_data_management_workbench3.0.0.0 – 3.0.0.0
• oracle / health_sciences_data_management_workbench2.5.2.1 – 2.5.2.1
• oracle / jd_edwards_enterpriseone_tools9.2.6.1
• oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
• oracle / peoplesoft_enterprise_peopletools8.59 – 8.59
• oracle / primavera_gateway17.12.0 – 17.12.11
• oracle / primavera_unifier20.12 – 20.12
• oracle / primavera_unifier19.12 – 19.12
• oracle / primavera_unifier18.8 – 18.8
• oracle / primavera_unifier17.7 – 17.12
• oracle / retail_customer_management_and_segmentation_foundation19.0 – 19.0
• Siemens / SINEC INS1.0
• Siemens / SINEC INS1.0 – 1.0
• Siemens / SINEC INS1.0 – 1.0

Exploits & proofs of concept

• nucleiLodash Template - Server-Side Template Injection (RCE)by DhiyaneshDk

References

• MISChttps://snyk.io/vuln/SNYK-JS-LODASH-1040724
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
• MISChttps://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
• MISChttps://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• MISChttps://security.netapp.com/advisory/ntap-20210312-0006/
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2022.html
• MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf