CVE-2024-36138

What it actually does

The vulnerability allows bypassing an incomplete fix for command injection in Node.js child_process.spawn and spawnSync on Windows by exploiting improper handling of batch file extensions, enabling arbitrary command execution via malicious arguments without enabling the shell option.

Why it matters to the business

Attackers can gain unauthorized code execution on Windows systems running affected applications, risking data compromise and system control. Low exploitation likelihood based on current metrics, with no known ransomware use or CISA deadlines.

How an attack unfolds

An attacker supplies a specially crafted command-line argument to functions like child_process.spawn when processing batch files, injecting and executing arbitrary commands on the target system.

How to fix it

Update affected packages to fixed versions such as mysql-client (Bitnami) to 10.4.25 or later equivalents from vendors.

How to confirm the fix worked

Verify package versions are updated and test that batch file handling no longer allows injection.

Typical attack path

1. Locate applications using vulnerable child_process calls on Windows
2. Craft and deliver malicious argument to trigger injection
3. Execute arbitrary commands for code execution

How to detect it

Examine logs for unusual command executions or arguments in processes using child_process, though specific indicators are limited.

What your security team should do

• Prioritize updating vulnerable dependencies
• Review code for child_process usage on Windows
• Monitor for any exploitation attempts