PT-2022-23152 · Shescape · Shescape

Ericcornelissen · Published 2022-09-06 · Updated 2023-07-21 · CVE-2022-36064

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Shescape versions prior to 1.5.10 Shescape version 1.5.9 for Bash

Description An Inefficient Regular Expression Complexity issue affects Shescape users who utilize it to escape arguments for Unix shells, including Bash and Dash, particularly when using the escape or escapeAll functions with the interpolation option set to true. This allows an attacker to cause polynomial backtracking or quadratic runtime in terms of the input string length due to vulnerable Regular Expressions. A workaround involves enforcing a maximum length on input strings to reduce the vulnerability's impact.

Recommendations For versions prior to 1.5.10, update to version 1.5.10 or later. For version 1.5.9 used with Bash, update to version 1.5.10 or later. As a temporary workaround, consider enforcing a maximum length on input strings to Shescape to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2022-36064

GHSA-GP75-H7J6-5PV3

Affected Products

Shescape

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36064.json · Exploit
• 🔥 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-gp75-h7j6-5pv3 · Exploit
• https://github.com/ericcornelissen/shescape/pull/373 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36064 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36064 · Vendor Advisory
• https://github.com/ericcornelissen/shescape/releases/tag/v1.5.10 · Note