CVE-2021-21414
📋 TL;DR
CVE-2021-21414 is an OS command injection vulnerability in Prisma's @prisma/sdk package that could allow remote code execution if the vulnerable getPackedPackage function is called with untrusted input. Only users who directly call this internal function are affected, as it's primarily used for testing and CLI building purposes.
💻 Affected Systems
- Prisma ORM
- @prisma/sdk package
📦 What is this software?
Prisma by Prisma
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application process, potentially leading to complete system compromise.
Likely Case
Limited impact since the vulnerable function is internal and not exposed in typical usage patterns.
If Mitigated
No impact if the vulnerable function is not called with untrusted input or if input validation is implemented.
🎯 Exploit Status
Exploitation requires calling the vulnerable internal function with malicious input, which is not typical in standard Prisma usage.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.20.0 and later
Vendor Advisory: https://github.com/prisma/prisma/security/advisories/GHSA-pxcc-hj8w-fmm7
Restart Required: Yes
Instructions:
1. Update @prisma/sdk to version 2.20.0 or later. 2. Update Prisma CLI to version 2.20.0 or later. 3. Restart any running applications using Prisma.
🔧 Temporary Workarounds
Input validation
allImplement strict input validation for any calls to getPackedPackage function
Avoid untrusted input
allEnsure getPackedPackage function is not called with user-controlled or untrusted data
🧯 If You Can't Patch
- Review codebase for any calls to getPackedPackage function and ensure they don't use untrusted input
- Implement network segmentation to limit potential impact if exploitation occurs
🔍 How to Verify
Check if Vulnerable:
Check if @prisma/sdk version is below 2.20.0 and if code calls getPackedPackage with untrusted inputCheck Version:
npm list @prisma/sdkVerify Fix Applied:
Verify @prisma/sdk version is 2.20.0 or higher and review code for getPackedPackage usage📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from Node.js applications
- Suspicious command execution patterns
Network Indicators:
- Unexpected outbound connections from application servers
SIEM Query:
process.name:node AND (process.cmdline:*getPackedPackage* OR process.cmdline:*prisma*)🔗 References
- https://github.com/prisma/prisma/pull/6245
- https://github.com/prisma/prisma/security/advisories/GHSA-pxcc-hj8w-fmm7
- https://security.netapp.com/advisory/ntap-20210618-0003/
- https://github.com/prisma/prisma/pull/6245
- https://github.com/prisma/prisma/security/advisories/GHSA-pxcc-hj8w-fmm7
- https://security.netapp.com/advisory/ntap-20210618-0003/
