PT-2022-21702 · Diffy · Diffy

Tehryanx · Published 2022-06-22 · Updated 2022-06-29 · CVE-2022-33127

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Diffy versions prior to 3.4.1 Diffy version 3.4.1

Description The function that calls the diff tool in Diffy does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string.

Recommendations For Diffy versions prior to 3.4.1, update to version 3.4.1 or later to resolve the issue. For Diffy version 3.4.1, consider disabling the function that calls the diff tool until a patch is available. Restrict access to the diff tool to minimize the risk of exploitation. Avoid using double quotes in filenames when running Diffy in a Windows environment until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2022-33127

GHSA-5WW9-9QP2-X524

Affected Products

Diffy

References · 11

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/diffy/CVE-2022-33127.yml · Exploit
• https://github.com/samg/diffy/commit/478f392082b66d38f54a02b4bb9c41be32fd6593 · Patch
• https://cve.org/CVERecord?id=CVE-2022-33127 · Security Note
• https://ubuntu.com/security/CVE-2022-33127 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5ww9-9qp2-x524 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33127 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-33127 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-33127 · Vendor Advisory
• https://github.com/samg/diffy/blob/56fd935aea256742f7352b050592542d3d153bf6/CHANGELOG#L1 · Note
• https://github.com/samg/diffy · Note
• https://t.me/cibsecurity/45002 · Telegram Post