DirectorySecurity Advisories
Sign In
Security Advisories

CGA-cvq8-8423-6v9f

Published

Last updated

https://images.chainguard.dev/security/CGA-cvq8-8423-6v9f
Package

jitsucom-jitsu

Latest Update
Not affected
Aliases
  • CVE-2016-10541
  • GHSA-qg8p-v9q4-gh34

Severity

9.8

Critical

CVSS V3

Summary

Potential Command Injection in shell-quote

Description

Affected versions of shell-quote do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.

Proof of Concept:

The following characters are not escaped properly: >,;,{,}

Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of {} and using the , instead of to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible.

   const quote = require('shell-quote').quote;
   console.log(quote(['a;{echo,test,123,234}']));
   // Actual                    "a;{echo,test,123,234}"
   // Expected                  "a\;\{echo,test,123,234\}"
   // Functional Equivalent     "a; echo 'test' '123' '1234'"

Recommendation

Update to version 1.6.1 or later.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2016-10541

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images