PT-2023-18616 · Nsa · Ghidra

Attilaszia · Publicado 2023-01-06 · Atualizado 2025-04-07 · CVE-2023-22671

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NSA Ghidra versions 10.2.2 and earlier

Description The issue arises from the Ghidra/RuntimeScripts/Linux/support/launch.sh script in NSA Ghidra, which passes user-provided input into eval, leading to command injection when analyzeHeadless is called with untrusted input.

Recommendations For NSA Ghidra versions 10.2.2 and earlier, consider disabling the analyzeHeadless function when dealing with untrusted input until a patch is available. Restrict access to the launch.sh script to minimize the risk of exploitation. Avoid using untrusted input when calling analyzeHeadless to prevent command injection.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2023-22671

Produtos afetados

Ghidra

Referências · 6

• 🔥 https://github.com/NationalSecurityAgency/ghidra/issues/4869 · Exploit
• https://github.com/NationalSecurityAgency/ghidra/pull/4872 · Correção
• https://t.me/cibsecurity/56039 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22671 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-22671 · Aviso do Fabricante
• https://t.me/cvenotify/118092 · Publicação no Telegram