PT-2022-24837 · Nuprocess · Nuprocess

Brettwooldridge · Published 2022-09-26 · Updated 2023-07-13 · CVE-2022-39243

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NuProcess versions 1.2.0 through 2.0.4

Description NuProcess is an external process execution implementation for Java that is vulnerable to command line injection attacks. Attackers can use NUL characters in their strings to inject command line arguments. This issue is specific to Linux and can be exploited due to the missing check in NuProcess, which is present in Java's ProcessBuilder. The vulnerability can only be exploited on Linux, as on macOS and Windows, any argument with a NUL character is truncated, preventing the malicious arguments from being seen by the started process.

Recommendations For NuProcess versions 1.2.0 through 2.0.4, update to version 2.0.5 to resolve the issue. As a temporary workaround for versions 1.2.0 through 2.0.4, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-39243

GHSA-CXGF-V2P8-7PH7

Affected Products

Nuprocess

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39243.json · Exploit
• 🔥 https://github.com/brettwooldridge/NuProcess/pull/143 · Exploit
• https://github.com/brettwooldridge/NuProcess/commit/29bc09de561bf00ff9bf77123756363a9709f868 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39243 · Security Note
• https://ubuntu.com/security/CVE-2022-39243 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39243 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39243 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cxgf-v2p8-7ph7 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-39243 · Vendor Advisory
• https://github.com/brettwooldridge/NuProcess · Note
• https://github.com/brettwooldridge/NuProcess/security/advisories/GHSA-cxgf-v2p8-7ph7 · Note
• https://t.me/cibsecurity/50489 · Telegram Post
• https://t.me/cvenotify/54293 · Telegram Post