PT-2023-20494 · Sketchsvg · Sketchsvg

Everardo Padilla · Publicado 2023-03-06 · Atualizado 2023-03-10 · CVE-2023-26107

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sketchsvg versions all

Description The issue is related to Arbitrary Code Injection when invoking shell.exec without proper sanitization or parametrization, specifically while concatenating the current directory as part of the command string. This allows for potential code injection attacks.

Recommendations For all versions, consider disabling the shell.exec function until a patch is available to prevent Arbitrary Code Injection attacks. Restrict access to sensitive directories and ensure proper sanitization and parametrization of command strings to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-26107

GHSA-6722-XVQ8-3254

Produtos afetados

Sketchsvg

Referências · 10

• 🔥 https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 · Exploit
• https://github.com/eBay/SketchSVG · Nota
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js#23L115 · Nota
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 · Nota
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js#23L64 · Nota
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64 · Nota
• https://t.me/cvenotify/45570 · Publicação no Telegram
• https://t.me/cibsecurity/59453 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26107 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-6722-xvq8-3254 · Aviso do Fabricante