PT-2021-14464 · Shescape · Shescape

Ericcornelissen · Published 2021-03-18 · Updated 2021-04-22 · CVE-2021-21384

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions shescape versions prior to 1.1.3

Description The issue affects shescape, a simple shell escape package for JavaScript, where users may still be vulnerable to shell injection if an attacker manages to insert a null character into the payload. This can be exploited, for example, by inserting a null character in a payload on Windows. The problem has been patched in version 1.1.3.

Recommendations For versions prior to 1.1.3, upgrade to version 1.1.3 to resolve the issue. As a temporary workaround, consider stripping out null characters manually using a method like arg.replace(/u{0}/gu, "") until the upgrade to version 1.1.3 is applied.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2021-21384

GHSA-F2RP-38VG-J3GH

Affected Products

Shescape

References · 10

• 🔥 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh · Exploit
• https://github.com/ericcornelissen/shescape/commit/07a069a66423809cbedd61d980c11ca44a29ea2b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21384 · Security Note
• https://osv.dev/vulnerability/GHSA-f2rp-38vg-j3gh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21384 · Vendor Advisory
• https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3 · Note
• https://t.me/cibsecurity/25160 · Telegram Post
• https://t.me/cvenotify/11553 · Telegram Post
• https://t.me/cvenotify/11986 · Telegram Post
• https://npmjs.com/package/shescape · Note