PT-2021-23080 · Elvish · Elvish

Xiaq · Published 2021-09-23 · Updated 2024-08-21 · CVE-2021-41088

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Elvish versions prior to 0.14.0

Description Elvish is a programming language and interactive shell. The web UI backend, started by elvish -web, hosts an endpoint that allows executing code sent from the web UI. However, the backend does not check the origin of requests correctly. This allows a malicious website to send arbitrary code to the endpoint in localhost if the user has the web UI backend open and visits the compromised website.

Recommendations For versions prior to 0.14.0, the issue can be patched by removing the web UI, found in web, pkg/web, or pkg/prog/web, depending on the exact version. As a temporary workaround, consider not using the experimental web UI until the issue is resolved.

Fix

Exposure of Resource to Wrong Sphere

Origin Validation Error

Weakness Enumeration

CWE-668

CWE-346

Related Identifiers

CVE-2021-41088

GHSA-FPV6-F8JW-RC3R

GO-2022-0937

Affected Products

Elvish

References · 14

• https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5 · Patch
• https://ubuntu.com/security/CVE-2021-41088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41088 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41088 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fpv6-f8jw-rc3r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41088 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41088 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-41088 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0937 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41088 · Vendor Advisory
• https://github.com/elves/elvish/security/advisories/GHSA-fpv6-f8jw-rc3r · Note
• https://github.com/elves/elvish · Note
• https://t.me/cvenotify/21359 · Telegram Post
• https://t.me/cibsecurity/29345 · Telegram Post