PT-2023-25389 · Shescape · Shescape

Ericcornelissen · Published 2023-06-22 · Updated 2023-07-04 · CVE-2023-35931

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shescape versions prior to 1.7.1

Description An attacker may be able to get read-only access to environment variables. This issue affects users of Shescape on Windows using the Windows Command Prompt, and when using quote/quoteAll or escape/escapeAll with the interpolation option set to true. For example, an attacker can exploit this by using a payload like %PATH% in the shescape.quote() or shescape.escape() functions, allowing them to access the contents of the PATH environment variable.

Recommendations For versions prior to 1.7.1, upgrade to version 1.7.1 to patch the bug. As a temporary workaround, consider removing all instances of % from user input, either before or after using Shescape, to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-526

Related Identifiers

CVE-2023-35931

GHSA-3G7P-8QHX-MC8R

Affected Products

Shescape

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35931.json · Exploit
• 🔥 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-3g7p-8qhx-mc8r · Exploit
• https://github.com/ericcornelissen/shescape/pull/982 · Patch
• https://github.com/ericcornelissen/shescape/commit/d0fce70f987ac0d8331f93cb45d47e79436173ac · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-35931 · Security Note
• https://osv.dev/vulnerability/GHSA-3g7p-8qhx-mc8r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35931 · Vendor Advisory
• https://github.com/ericcornelissen/shescape · Note
• https://github.com/ericcornelissen/shescape/releases/tag/v1.7.1 · Note
• https://t.me/cvenotify/53021 · Telegram Post
• https://t.me/cvenotify/52977 · Telegram Post