PT-2022-7691 · Tinygltf+2 · Tinygltf+2

Oliverchang · Published 2022-09-05 · Updated 2024-11-26 · CVE-2022-3008

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions tinygltf versions prior to 2.6.0

Description The tinygltf library has an issue related to the use of the C library function wordexp() for file path expansion on untrusted paths from input files. This allows for command injection using backticks. An attacker could craft a malicious path input to exploit this, potentially leading to arbitrary code execution by sending specially formed commands.

Recommendations For versions prior to 2.6.0, upgrade to version 2.6.0 or apply the changes from commit 52ff00a38447f06a17eab1caa2cf0730a119c751 to resolve the issue. As a temporary workaround, consider restricting the use of the wordexp() function until a patch is applied.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2024-10529

CVE-2022-3008

DSA-5232-1

USN-7129-1

Affected Products

Linuxmint

Ubuntu

Tinygltf

References · 16

• 🔥 https://github.com/syoyo/tinygltf/issues/368 · Exploit
• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053 · Exploit
• https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c751 · Patch
• https://osv.dev/vulnerability/DSA-5232-1 · Vendor Advisory
• https://debian.org/security/2022/dsa-5232 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10529 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3008 · Security Note
• https://ubuntu.com/security/notices/USN-7129-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3008 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3008 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7129-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3008 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-3008 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3008 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3008 · Vendor Advisory