CVE-2021-24033

What it actually does

CVE-2021-24033 is a command injection vulnerability in react-dev-utils before version 11.0.4. The vulnerable getProcessForPort function builds an operating-system command by concatenating an input argument into a command string before execution. If application or tooling code manually calls this function with attacker-controlled input, an attacker may inject shell metacharacters or additional commands. Successful exploitation can allow arbitrary command execution with the privileges of the Node.js process invoking the function. In typical Create React App usage through react-scripts, the vulnerable path is considered safe because user-controlled values are not normally passed to the function.

Why it matters to the business

The main risk is compromise of development, build, or custom Node.js tooling environments that directly use the vulnerable helper with untrusted input. If exploited, an attacker could run commands, read limited local data, modify build artifacts, steal credentials available to the process, or disrupt developer tooling. The issue has moderate severity, relatively low EPSS, and is not listed in the CISA Known Exploited Vulnerabilities catalog, but public exploit knowledge exists and the package is common in React-based development ecosystems, so organizations should still remove vulnerable versions from dependency trees.

How an attack unfolds

An attacker first needs to reach code that manually invokes react-dev-utils getProcessForPort with a value they can influence. This is not the normal safe usage through react-scripts; exploitation generally requires custom server, CLI, development tool, API route, or automation code that passes user-controlled input into the function. The attacker supplies a crafted port argument containing shell control characters, command separators, or command substitution syntax. Because the vulnerable implementation concatenates that argument into a command string, the shell interprets the injected content as an additional command. The injected command then runs under the same user account and environment as the Node.js process, which may expose source code, environment variables, package tokens, cloud credentials, SSH keys, or build output depending on where the vulnerable tooling runs.

How to fix it

Upgrade react-dev-utils to version 11.0.4 or later wherever it is directly or transitively installed. If using Create React App through react-scripts without manually invoking getProcessForPort with user-provided input, the vulnerable condition is not normally reachable, but upgrading remains recommended to eliminate scanner findings and future misuse. Audit custom code for imports or references to react-dev-utils getProcessForPort and ensure no untrusted input is passed to it. If immediate upgrade is not possible, remove direct use of getProcessForPort, strictly validate port inputs as numeric values in the valid TCP/UDP port range, avoid shell execution with concatenated strings, and use safe process-spawning APIs with argument arrays rather than shell-interpreted command strings. Refresh lockfiles and rebuild containers or artifacts so older dependency versions are not retained.

How to confirm the fix worked

Confirm package resolution using package manager tooling such as npm ls react-dev-utils, yarn why react-dev-utils, pnpm why react-dev-utils, or software composition analysis reports. The installed version should be 11.0.4 or newer. Inspect package-lock.json, yarn.lock, pnpm-lock.yaml, container images, and build caches for react-dev-utils versions earlier than 11.0.4. Search source code for getProcessForPort imports or calls and verify that any remaining use does not receive externally controlled input. Exercise relevant development or automation paths with benign special characters in the port parameter to confirm they are rejected or treated as data, not executed. Re-run dependency scanning after lockfile updates and rebuild all shipped artifacts from the updated dependency set.

Typical attack path

1. Identify an application, development service, build tool, CLI wrapper, or automation endpoint that uses react-dev-utils before 11.0.4.
2. Determine whether custom code calls getProcessForPort directly rather than only through normal react-scripts usage.
3. Find an input path where the attacker can control the port argument passed to getProcessForPort.
4. Submit a payload containing shell metacharacters or command separators as the port value.
5. Cause the vulnerable Node.js process to construct and execute the concatenated command string.
6. Run attacker-chosen commands with the privileges and environment of the invoking process.
7. Use the access to read local files, capture environment variables, alter build artifacts, install persistence in the developer/build environment, or pivot to other systems accessible from that context.

How to detect it

To determine whether exploitation already occurred, focus on systems where vulnerable custom code executed: developer workstations, CI/CD runners, build containers, preview servers, internal tooling hosts, and Node.js services that import react-dev-utils directly. Review application logs for unexpected or malformed port values, especially values containing shell metacharacters such as semicolons, pipes, ampersands, backticks, dollar-parentheses command substitution, redirection, or newline characters. Correlate Node.js process activity with endpoint telemetry showing child processes such as sh, bash, cmd.exe, powershell.exe, curl, wget, nc, ncat, python, perl, ruby, or package-manager commands spawned unexpectedly. Examine shell history, CI job logs, build logs, npm/yarn script output, and container runtime logs for commands executed near getProcessForPort errors or port-detection activity. Look for post-exploitation artifacts such as newly created scripts in temporary directories, unexpected outbound network connections from build systems, modified package files, altered build artifacts, or access to credential files and environment secrets. There are no CVE-specific network indicators; detection should be behavior-based around suspicious port input and unexpected child process execution from Node.js.

• react-dev-utils
• getProcessForPort
• node_modules/react-dev-utils
• node_modules/react-dev-utils/getProcessForPort
• ;curl
• ; wget
• |curl
• | wget
• && curl
• && wget
• `curl
• $(curl
• $(wget
• nc -e
• ncat -e
• /bin/sh -c
• /bin/bash -c
• cmd.exe /c
• powershell.exe -Command
• powershell -enc
• python -c
• perl -e
• ruby -e
• /tmp/.
• /var/tmp/.

What your security team should do

• Inventory all projects and build images that include react-dev-utils and prioritize those with versions earlier than 11.0.4.
• Upgrade react-dev-utils to 11.0.4 or later and regenerate lockfiles across affected repositories.
• Search codebases for direct calls to getProcessForPort and review whether any caller accepts web, CLI, CI variable, configuration, or other untrusted input.
• Treat internet-accessible or shared internal tooling that passes user input to this function as higher priority than ordinary Create React App usage through react-scripts.
• Harden build and developer environments by limiting secrets exposed as environment variables and restricting network egress from CI jobs where feasible.
• Add dependency policy checks to prevent reintroduction of react-dev-utils versions earlier than 11.0.4.
• Review logs and host telemetry for suspicious child processes spawned by Node.js around times when vulnerable tooling was used.