critical9.8
CVE-2021-32090
The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.
Impact
The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Localstack | Localstack | Version 0.12.6 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.sonarsource.com/hack-the-stack-with-localstack
- https://portswigger.net/daily-swig/localstack-zero-day-vulnerabilities-chained-to-achieve-remote-takeover-of-local-instances
- https://blog.sonarsource.com/hack-the-stack-with-localstack
- https://portswigger.net/daily-swig/localstack-zero-day-vulnerabilities-chained-to-achieve-remote-takeover-of-local-instances