CVE-2016-10532
Description
console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication and execute any command that the user who is running the console-io application 2.2.13 and earlier is able to run. This means that if console-io was running from root, the attacker would have full access to the system. This vulnerability exists because the console-io application does not configure socket.io to require authentication, which allows a malicious user to connect via a websocket to send commands and receive the response.
How to fix
- console-io2.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| console-io_project console-io | v ≤ 2.2.13 | — |
| console-ionpm | v < 2.3.0 | 2.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.