PT-2023-20494 · Sketchsvg · Sketchsvg

Everardo Padilla · Published 2023-03-06 · Updated 2023-03-10 · CVE-2023-26107

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sketchsvg versions all

Description The issue is related to Arbitrary Code Injection when invoking shell.exec without proper sanitization or parametrization, specifically while concatenating the current directory as part of the command string. This allows for potential code injection attacks.

Recommendations For all versions, consider disabling the shell.exec function until a patch is available to prevent Arbitrary Code Injection attacks. Restrict access to sensitive directories and ensure proper sanitization and parametrization of command strings to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-26107

GHSA-6722-XVQ8-3254

Affected Products

Sketchsvg

References · 10

• 🔥 https://security.snyk.io/vuln/SNYK-JS-SKETCHSVG-3167969 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-26107 · Security Note
• https://osv.dev/vulnerability/GHSA-6722-xvq8-3254 · Vendor Advisory
• https://github.com/eBay/SketchSVG · Note
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js#23L115 · Note
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 · Note
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js#23L64 · Note
• https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L64 · Note
• https://t.me/cvenotify/45570 · Telegram Post
• https://t.me/cibsecurity/59453 · Telegram Post