PT-2020-14587 · Nim+1 · Nim+1

Tintinweb · Published 2020-08-14 · Updated 2024-06-15 · CVE-2020-15692

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nim version 1.2.4

Description The standard library browsers in Nim mishandle the URL argument to browsers.openDefaultBrowser(), allowing an attacker to pass an argument to the underlying open command and execute arbitrary registered system commands. This can occur when the URL argument is a local file path that will be opened in the default explorer.

Recommendations For Nim version 1.2.4, consider disabling the browsers.openDefaultBrowser() function until a patch is available to prevent exploitation. Restrict access to the browsers module to minimize the risk of arbitrary command execution. Avoid using the openDefaultBrowser function with untrusted input until the issue is resolved.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

ALT-PU-2020-3173

CVE-2020-15692

OPENSUSE-SU-2022:10095-1

OPENSUSE-SU-2022:10101-1

OPENSUSE-SU-2024:12253-1

Affected Products

Alt Linux

Nim

References · 35

• 🔥 http://openwall.com/lists/oss-security/2021/02/04/1 · Exploit
• 🔥 https://consensys.net/diligence/vulnerabilities/nim-browsers-argument-injection · Exploit
• https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/browsers.nim#L48 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15692 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-15692 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15692 · Security Note
• https://ubuntu.com/security/CVE-2020-15692 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10095-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12253-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15692 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15692 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10101-1 · Vendor Advisory
• https://lists.opensuse.org/archives/list/[e-mail]/thread/HM5F2H5AWO4WRQSTOWMODGKMXAHHBVRH · Note
• https://suse.com/security/cve/CVE-2020-15690 · Note