PT-2022-20591 · Shescape · Shescape

Ericcornelissen · Published 2022-07-15 · Updated 2022-08-09 · CVE-2022-31179

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Shescape versions prior to 1.5.8

Description The issue impacts users of Shescape who use any API function to escape arguments for cmd.exe on Windows. An attacker can omit all arguments following their input by including a line feed character ( ) in the payload. This allows for code injection on Windows.

Recommendations For versions prior to 1.5.8, upgrade to version 1.5.8 to resolve the issue. No further changes are required. Alternatively, line feed characters ( ) can be stripped out manually or the user input can be made the last argument to limit the impact.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2022-31179

GHSA-JJC5-FP7P-6F8W

Affected Products

Shescape

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31179.json · Exploit
• 🔥 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w · Exploit
• https://github.com/ericcornelissen/shescape/pull/332 · Patch
• https://osv.dev/vulnerability/CVE-2022-31179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31179 · Security Note
• https://osv.dev/vulnerability/GHSA-jjc5-fp7p-6f8w · Vendor Advisory
• https://github.com/ericcornelissen/shescape · Note
• https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8 · Note
• https://github.com/ericcornelissen/shescape/commit/aceea7358f7222984e21260381ebc5ec4543b76f · Note
• https://t.me/cibsecurity/47379 · Telegram Post