CWE Code: 78
Vulnerability Type: privilege_escalation
CVSS Score: 10.0
CWE Name:  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary: voice builder prior to commit c145d4604df67e6fc625992412eef0bf9a85e26b and f6660e6d8f0d1d931359d591dbdec580fef36d36 is affected by: cwe-78: improper neutralization of special elements used in an os command ('os command injection'). the impact is: remote code execution with the same privileges as the servers. the component is: two web servers in the projects expose three vulnerable endpoints that can be accessed remotely. the endpoints are defined at: - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/merlin_model_server/api.js#l34 - /alignment: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#l28 - /tts: https://github.com/google/voice-builder/blob/3a449a3e8d5100ff323161c89b897f6d5ccdb6f9/festival_model_server/api.js#l65. the attack vector is: attacker sends a get request to the vulnerable endpoint with a specially formatted query parameter. the fixed version is: after commit f6660e6d8f0d1d931359d591dbdec580fef36d36.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-07-23
Last Modified Date: 2019-10-09