PT-2021-4640 · Unknown · Unicode Specification

Nicholas Boucher + 1 · Published 2021-11-01 · Updated 2024-10-29 · CVE-2021-42694

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Unicode Specification versions through 14.0

Description An issue was discovered in the character definitions of the Unicode Specification. The specification allows an adversary to produce source code identifiers, such as function names, using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. This issue can affect applications that implement support for The Unicode Standard, allowing an adversary to produce source code identifiers using homoglyph characters that render visually identical to but are distinct from a target identifier.

Recommendations For Unicode Specification versions through 14.0, consider implementing the mitigations provided in Unicode Technical Standard #39, Unicode Security Mechanisms, to address the issue of homoglyph characters being used to inject adversarial identifier definitions. As a temporary workaround, developers can review their code to detect and prevent the use of homoglyph characters in source code identifiers. Additionally, restricting the use of international text that can be affected by this issue may help minimize the risk of exploitation until a more permanent solution is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2021-05329

CVE-2021-42694

Affected Products

Unicode Specification

References · 24

• 🔥 https://github.com/js-on/CVE-2021-42694 · Exploit
• 🔥 https://github.com/simplylu/CVE-2021-42694 · Exploit
• 🔥 https://scyon.nl/post/trojans-in-your-source-code · Exploit
• http://unicode.org/versions/Unicode14.0.0 · Vendor Advisory
• https://unicode.org/reports/tr36 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-09 · Vendor Advisory
• https://unicode.org/reports/tr39 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05329 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42694 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42694 · Security Note
• https://github.com/nickboucher/trojan-source · Note
• https://t.me/cvenotify/88912 · Telegram Post
• https://t.me/cvenotify/86664 · Telegram Post
• https://cwe.mitre.org/data/definitions/1007.html · Note
• http://openwall.com/lists/oss-security/2021/11/01/6 · Note