CVE-2023-27849
Published: 24 April 2023
Summary
CVE-2023-27849 is a critical-severity Command Injection (CWE-77) vulnerability in Rails-Routes-To-Json Project Rails-Routes-To-Json. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
rails-routes-to-json version 1.0.0 contains a remote code execution vulnerability that stems from the use of the child_process function, corresponding to CWE-77. The issue affects this npm package and carries a CVSS v3.1 score of 9.8, reflecting network-exploitable conditions with no authentication or user interaction required and full impact on confidentiality, integrity, and availability.
An unauthenticated attacker with network access can exploit the flaw to execute arbitrary code on the affected system, potentially leading to complete compromise of the host running the vulnerable package.
The provided references point to a detailed vulnerability report and the package's npm listing, but contain no specific information on patches or mitigation steps. The EPSS score has remained low with a current value of 0.0585 and a peak of 0.0588.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-31584
Vulnerability details
rails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.