cbcvebase.
CVE-2020-28429
published 2021-02-23

CVE-2020-28429: All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch…

PriorityP276critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
63.30%
99.1th percentile
All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})

Detection & IOCsextracted from sources · hover to see the quote

command& touch JHU↗
command& echo "{{randstr}}" > {{filename}}.txt && ls↗
path/convert↗
path/file/↗
  • →Exploit targets the `fileName` parameter in a JSON POST body to `/convert`; inject shell metacharacters (e.g., `&`, `&&`, `;`) to achieve OS command execution via the geojson2kml index.js file. ↗
  • →Verify exploitation by checking for creation of an attacker-controlled file via GET /file/<name>.txt returning HTTP 200 with text/html content-type and the injected string in the body. ↗
  • →Monitor for POST requests to `/convert` with a `fileName` field containing shell metacharacters (`&`, `|`, `;`, `>`) in the JSON body — this is the injection vector. ↗
  • →Tag as intrusive/active exploitation attempt; the nuclei template is classified with tags: cve, cve2020, rce, geojson2kml, file-upload, intrusive, vuln. ↗
  • ·All versions of geojson2kml are affected; there is no fixed version available — the package should not be used. ↗
  • ·The nuclei detection template requires two sequential requests (POST to /convert, then GET to /file/<name>.txt) and is marked intrusive — it will create files on the target system during detection. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.