PT-2023-27313 · Shescape · Shescape

Ericcornelissen · Published 2023-08-22 · Updated 2023-09-01 · CVE-2023-40185

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Shescape versions prior to 1.7.4

Description The issue affects users of Shescape on Windows in a threaded context, allowing attackers to bypass protections by exploiting Shescape's failure to correctly escape for the expected shell. This can occur when the expected default system shell is different from the one actually used, such as when configuring the use of PowerShell but Shescape defaults to escaping for CMD instead.

Recommendations For versions prior to 1.7.4, upgrade to version 1.7.4 to resolve the issue. If you are impacted and cannot upgrade immediately, be aware that there is no workaround possible for this vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-150

Related Identifiers

CVE-2023-40185

GHSA-J55R-787P-M549

Affected Products

Shescape

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40185.json · Exploit
• 🔥 https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j55r-787p-m549 · Exploit
• https://github.com/ericcornelissen/shescape/commit/0b976dab645abf45ffd85e74a8c6e51ee2f42d63 · Patch
• https://github.com/ericcornelissen/shescape/pull/1142 · Patch
• https://osv.dev/vulnerability/CVE-2023-40185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40185 · Security Note
• https://osv.dev/vulnerability/GHSA-j55r-787p-m549 · Vendor Advisory
• https://github.com/ericcornelissen/shescape · Note
• https://github.com/ericcornelissen/shescape/releases/tag/v1.7.4 · Note
• https://t.me/cibsecurity/69096 · Telegram Post