CyberRota Analysis
AI-GeneratedElecterm versions prior to 3.15.120 are vulnerable to command injection via malicious FTP or SFTP servers, allowing attackers to execute arbitrary commands when users download crafted folders and invoke the Properties and Calculate Size function. This vulnerability poses a significant risk as it can lead to unauthorized command execution on the user's system. Organizations using Electerm should prioritize upgrading to version 3.15.120 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.