Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-qg8p-v9q4-gh34

Опубликовано: 18 фев. 2019
Источник: github
Github: Прошло ревью
CVSS3: 9.8

Описание

Potential Command Injection in shell-quote

Affected versions of shell-quote do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.

Proof of Concept:

The following characters are not escaped properly: >,;,{,}

Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of {} and using the , instead of to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible.

const quote = require('shell-quote').quote; console.log(quote(['a;{echo,test,123,234}'])); // Actual "a;{echo,test,123,234}" // Expected "a\;\{echo,test,123,234\}" // Functional Equivalent "a; echo 'test' '123' '1234'"

Recommendation

Update to version 1.6.1 or later.

Пакеты

Наименование

shell-quote

npm
Затронутые версииВерсия исправления

< 1.6.1

1.6.1

EPSS

Процентиль: 60%
0.00397
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-78
CWE-94

Связанные уязвимости

CVSS3: 9.8
ubuntu
больше 7 лет назад

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.

CVSS3: 8.4
redhat
больше 9 лет назад

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.

CVSS3: 9.8
nvd
больше 7 лет назад

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.

CVSS3: 9.8
debian
больше 7 лет назад

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ...

EPSS

Процентиль: 60%
0.00397
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-78
CWE-94