CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8400 vulnerabilities reference this CWE, most recent first.
GHSA-6436-83PC-5GXW
Vulnerability from github – Published: 2023-11-10 00:30 – Updated: 2023-11-10 00:30Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
{
"affected": [],
"aliases": [
"CVE-2023-36014"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-10T00:15:08Z",
"severity": "HIGH"
},
"details": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
"id": "GHSA-6436-83pc-5gxw",
"modified": "2023-11-10T00:30:27Z",
"published": "2023-11-10T00:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36014"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36014"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6457-MXPQ-4FQQ
Vulnerability from github – Published: 2026-04-22 17:42 – Updated: 2026-05-11 13:29Summary
Versions of i18nextify prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution logic in src/localize.js (replaceInside handler around line 122) only guards against a duplicated http:// origin prefix — it does not validate the URL scheme of the substituted value. A translated value such as javascript:alert(1) or data:text/html,<script>...</script> is applied unchanged to the live DOM attribute.
Impact
When an attacker can influence the content of a translation file or the translation-backend response — compromised translation CDN, user-contributed locales, MITM on a plain-HTTP backend, write access to the translation JSON — they can:
- Set any
hrefon an anchor to ajavascript:URI, executing arbitrary JavaScript when the victim clicks the link. - Set any
srcon<iframe>,<object>, or<embed>to adata:text/htmlURI containing a full script payload that runs in the page's origin. - Use
vbscript:on legacy IE installations orfile:for local-resource navigation attacks.
This path is distinct from the general i18nextify design that intentionally renders HTML from translations — href/src schemes are narrow and attack-specific, and no legitimate translation needs javascript: or data:. The fix therefore blocks these schemes outright without changing other behaviour.
Also fixed in 4.0.8
debug/saveMissingURL-parameter substring match. The previous detectionwindow.location.search.indexOf('debug=true') > -1matched the substring anywhere in the query string. A URL like?nosaveMissing=truesilently enabledsaveMissingmode, causing the victim's browser to POST every unknown translation key to the configuredaddPath— a form of CSRF-style abuse of missing-key reporting.?track_debug=trueenabled verbose debug logging, leaking i18next internals to the console. Now usesURLSearchParamsfor exact parameter matching.- Optional
sanitize(html, ctx)hook. The library's core purpose is to render HTML from translations — a behaviour that is safe only when the translation source is fully trusted. Applications with partially-trusted sources (user-contributed locales, third-party CDN, MITM-exposed HTTP backend) can now wire a sanitizer (e.g. DOMPurify) viai18next.options.sanitize. Defaults to pass-through to preserve existing behaviour for the main use case.
Affected versions
All versions of i18nextify prior to 4.0.8.
Patch
Fixed in 4.0.8. The URL-scheme blocklist is ^\s*(javascript|data|vbscript|file)\s*: (case-insensitive) applied to each translated value before it is joined back into the href/src attribute. Values matching the blocklist are replaced with an empty string so the attribute becomes harmless rather than leaving the attacker's URL in place.
Workarounds
No workaround short of upgrading. If you cannot upgrade immediately, audit every translation file for javascript:, data:, vbscript:, and file: prefixes in any value that may reach an href/src position, and restrict translation-file write access to trusted operators. Serving translations over HTTPS and pinning the translation backend to an internal origin reduce the MITM surface.
Credits
Discovered via an internal security audit of the i18next ecosystem.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "i18nextify"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41692"
],
"database_specific": {
"cwe_ids": [
"CWE-79",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-22T17:42:24Z",
"nvd_published_at": "2026-05-07T21:16:29Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nVersions of `i18nextify` prior to 4.0.8 substitute `{{key}}` interpolation tokens inside `src` and `href` attribute values with the raw string returned by `i18next.t()`. The substitution logic in `src/localize.js` (`replaceInside` handler around line 122) only guards against a duplicated `http://` origin prefix \u2014 it does not validate the URL scheme of the substituted value. A translated value such as `javascript:alert(1)` or `data:text/html,\u003cscript\u003e...\u003c/script\u003e` is applied unchanged to the live DOM attribute.\n\n### Impact\n\nWhen an attacker can influence the content of a translation file or the translation-backend response \u2014 compromised translation CDN, user-contributed locales, MITM on a plain-HTTP backend, write access to the translation JSON \u2014 they can:\n\n- Set any `href` on an anchor to a `javascript:` URI, executing arbitrary JavaScript when the victim clicks the link.\n- Set any `src` on `\u003ciframe\u003e`, `\u003cobject\u003e`, or `\u003cembed\u003e` to a `data:text/html` URI containing a full script payload that runs in the page\u0027s origin.\n- Use `vbscript:` on legacy IE installations or `file:` for local-resource navigation attacks.\n\nThis path is distinct from the general i18nextify design that intentionally renders HTML from translations \u2014 href/src schemes are narrow and attack-specific, and no legitimate translation needs `javascript:` or `data:`. The fix therefore blocks these schemes outright without changing other behaviour.\n\n### Also fixed in 4.0.8\n\n- **`debug` / `saveMissing` URL-parameter substring match.** The previous detection `window.location.search.indexOf(\u0027debug=true\u0027) \u003e -1` matched the substring anywhere in the query string. A URL like `?nosaveMissing=true` silently enabled `saveMissing` mode, causing the victim\u0027s browser to POST every unknown translation key to the configured `addPath` \u2014 a form of CSRF-style abuse of missing-key reporting. `?track_debug=true` enabled verbose debug logging, leaking i18next internals to the console. Now uses `URLSearchParams` for exact parameter matching.\n- **Optional `sanitize(html, ctx)` hook.** The library\u0027s core purpose is to render HTML from translations \u2014 a behaviour that is safe only when the translation source is fully trusted. Applications with partially-trusted sources (user-contributed locales, third-party CDN, MITM-exposed HTTP backend) can now wire a sanitizer (e.g. DOMPurify) via `i18next.options.sanitize`. Defaults to pass-through to preserve existing behaviour for the main use case.\n\n### Affected versions\n\nAll versions of `i18nextify` prior to **4.0.8**.\n\n### Patch\n\nFixed in **4.0.8**. The URL-scheme blocklist is `^\\s*(javascript|data|vbscript|file)\\s*:` (case-insensitive) applied to each translated value before it is joined back into the `href`/`src` attribute. Values matching the blocklist are replaced with an empty string so the attribute becomes harmless rather than leaving the attacker\u0027s URL in place.\n\n### Workarounds\n\nNo workaround short of upgrading. If you cannot upgrade immediately, audit every translation file for `javascript:`, `data:`, `vbscript:`, and `file:` prefixes in any value that may reach an `href`/`src` position, and restrict translation-file write access to trusted operators. Serving translations over HTTPS and pinning the translation backend to an internal origin reduce the MITM surface.\n\n### Credits\n\nDiscovered via an internal security audit of the i18next ecosystem.",
"id": "GHSA-6457-mxpq-4fqq",
"modified": "2026-05-11T13:29:23Z",
"published": "2026-04-22T17:42:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41692"
},
{
"type": "WEB",
"url": "https://github.com/i18next/i18nextify/commit/16f23dbcdcf893673587f7a03355bf7ce0a0e49e"
},
{
"type": "PACKAGE",
"url": "https://github.com/i18next/i18nextify"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes"
}
GHSA-64C8-JXWR-FXQ6
Vulnerability from github – Published: 2022-05-01 17:47 – Updated: 2022-05-01 17:47Remote file inclusion vulnerability in scripts2/objcache in cPanel WebHost Manager (WHM) allows remote attackers to execute arbitrary code via a URL in the obj parameter. NOTE: a third party claims that this issue is not file inclusion because the contents are not parsed, but the attack can be used to overwrite files in /var/cpanel/objcache or provide unexpected web page contents.
{
"affected": [],
"aliases": [
"CVE-2007-0854"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-02-08T18:28:00Z",
"severity": "HIGH"
},
"details": "Remote file inclusion vulnerability in scripts2/objcache in cPanel WebHost Manager (WHM) allows remote attackers to execute arbitrary code via a URL in the obj parameter. NOTE: a third party claims that this issue is not file inclusion because the contents are not parsed, but the attack can be used to overwrite files in /var/cpanel/objcache or provide unexpected web page contents.",
"id": "GHSA-64c8-jxwr-fxq6",
"modified": "2022-05-01T17:47:35Z",
"published": "2022-05-01T17:47:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-0854"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32400"
},
{
"type": "WEB",
"url": "http://changelog.cpanel.net/index.cgi"
},
{
"type": "WEB",
"url": "http://osvdb.org/32043"
},
{
"type": "WEB",
"url": "http://osvdb.org/33240"
},
{
"type": "WEB",
"url": "http://osvdb.org/35750"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/24097"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/459409/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/459449/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/22455"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/0545"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-64RW-MJ5Q-W82V
Vulnerability from github – Published: 2022-05-01 23:54 – Updated: 2022-05-01 23:54Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote attackers to execute arbitrary commands via the --command parameter in an ircs:// URI.
{
"affected": [],
"aliases": [
"CVE-2008-2841"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-06-24T19:41:00Z",
"severity": "MODERATE"
},
"details": "Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote attackers to execute arbitrary commands via the --command parameter in an ircs:// URI.",
"id": "GHSA-64rw-mj5q-w82v",
"modified": "2022-05-01T23:54:00Z",
"published": "2022-05-01T23:54:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2841"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43065"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/5795"
},
{
"type": "WEB",
"url": "http://forum.xchat.org/viewtopic.php?t=4218"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30695"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/29696"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-64VJ-933F-6PM3
Vulnerability from github – Published: 2024-05-15 21:28 – Updated: 2024-05-15 21:28This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.
Update: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ezsystems/ezpublish-kernel"
},
"ranges": [
{
"events": [
{
"introduced": "7.5.0"
},
{
"fixed": "7.5.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ezsystems/ezpublish-kernel"
},
"ranges": [
{
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.13.6.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ezsystems/ezpublish-kernel"
},
"ranges": [
{
"events": [
{
"introduced": "5.4.0"
},
{
"fixed": "5.4.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-15T21:28:27Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.\n\nUpdate: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.",
"id": "GHSA-64vj-933f-6pm3",
"modified": "2024-05-15T21:28:27Z",
"published": "2024-05-15T21:28:27Z",
"references": [
{
"type": "WEB",
"url": "https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-kernel/2020-05-20-1.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/ezsystems/ezpublish-kernel"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "eZ Platform Object Injection in SiteAccessMatchListener"
}
GHSA-64VW-HQ5R-5QMJ
Vulnerability from github – Published: 2026-05-15 15:30 – Updated: 2026-05-15 18:30Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method ScriptRunner.run(String expression, String type, Map context) evaluates attacker-controlled script expressions through the underlying script engine without sandboxing or allowlist restrictions.
{
"affected": [],
"aliases": [
"CVE-2026-39052"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-15T15:16:51Z",
"severity": "MODERATE"
},
"details": "Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method ScriptRunner.run(String expression, String type, Map\u003cString, Object\u003e context) evaluates attacker-controlled script expressions through the underlying script engine without sandboxing or allowlist restrictions.",
"id": "GHSA-64vw-hq5r-5qmj",
"modified": "2026-05-15T18:30:33Z",
"published": "2026-05-15T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39052"
},
{
"type": "WEB",
"url": "https://gist.github.com/Misakim1/859c3eb9ced699089ee0747dae9bedc1"
},
{
"type": "WEB",
"url": "https://github.com/oinone/oinone-pamirs"
},
{
"type": "WEB",
"url": "https://www.oinone.top/changelog"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-64X7-XW3H-6782
Vulnerability from github – Published: 2022-05-01 18:26 – Updated: 2022-05-01 18:26Unspecified vulnerability in the Shared Trace Service in Hitachi JP1/Cm2/Network Node Manager (NNM) 07-10 through 07-10-05, and NNM Starter Edition Enterprise and 250 08-00 through 08-10, allows remote attackers to execute arbitrary code via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2007-4720"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-09-05T19:17:00Z",
"severity": "MODERATE"
},
"details": "Unspecified vulnerability in the Shared Trace Service in Hitachi JP1/Cm2/Network Node Manager (NNM) 07-10 through 07-10-05, and NNM Starter Edition Enterprise and 250 08-00 through 08-10, allows remote attackers to execute arbitrary code via unspecified vectors.",
"id": "GHSA-64x7-xw3h-6782",
"modified": "2022-05-01T18:26:29Z",
"published": "2022-05-01T18:26:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4720"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36374"
},
{
"type": "WEB",
"url": "http://osvdb.org/37859"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26668"
},
{
"type": "WEB",
"url": "http://www.hitachi-support.com/security_e/vuls_e/HS07-030_e/index-e.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/25520"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/3035"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6556-FWC2-FG2P
Vulnerability from github – Published: 2025-12-30 15:20 – Updated: 2026-07-18 17:27Summary
Picklescan uses the numpy.f2py.crackfortran._eval_length function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.
Details
Picklescan fails to detect a malicious pickle that uses the gadget numpy.f2py.crackfortran._eval_length in __reduce__, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker‑controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.
PoC
class PoC:
def __reduce__(self):
from numpy.f2py.crackfortran import _eval_length
return _eval_length, ("__import__('os').system('whoami')", None)
Impact
- Arbitrary code execution on the victim machine once they load the “scanned as safe” pickle / model file.
- Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.
- Enables supply‑chain poisoning of shared model files.
Credits
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "picklescan"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.33"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-71339"
],
"database_specific": {
"cwe_ids": [
"CWE-502",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-30T15:20:14Z",
"nvd_published_at": "2026-06-22T22:16:45Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nPicklescan uses the `numpy.f2py.crackfortran._eval_length` function (a NumPy F2PY helper) to execute arbitrary Python code during unpickling.\n\n### Details\n\nPicklescan fails to detect a malicious pickle that uses the gadget `numpy.f2py.crackfortran._eval_length` in `__reduce__`, allowing arbitrary command execution when the pickle is loaded. A crafted object returns this function plus attacker\u2011controlled arguments; the scan reports the file as safe, but pickle.load() triggers execution.\n\n### PoC\n```python\nclass PoC:\n def __reduce__(self):\n from numpy.f2py.crackfortran import _eval_length\n return _eval_length, (\"__import__(\u0027os\u0027).system(\u0027whoami\u0027)\", None)\n```\n\n### Impact\n\n- Arbitrary code execution on the victim machine once they load the \u201cscanned as safe\u201d pickle / model file.\n- Affects any workflow relying on Picklescan to vet untrusted pickle / PyTorch artifacts.\n- Enables supply\u2011chain poisoning of shared model files.\n\n### Credits\n- [ac0d3r](https://github.com/ac0d3r)\n- [Tong Liu](https://lyutoon.github.io), Institute of information engineering, CAS",
"id": "GHSA-6556-fwc2-fg2p",
"modified": "2026-07-18T17:27:24Z",
"published": "2025-12-30T15:20:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/security/advisories/GHSA-6556-fwc2-fg2p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71339"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/pull/53"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/commit/70c1c6c31beb6baaf52c8db1b6c3c0e84a6f9dab"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6556-fwc2-fg2p"
},
{
"type": "PACKAGE",
"url": "https://github.com/mmaitre314/picklescan"
},
{
"type": "WEB",
"url": "https://github.com/mmaitre314/picklescan/releases/tag/v0.0.33"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/picklescan/PYSEC-2026-1783.yaml"
},
{
"type": "WEB",
"url": "https://pypi.org/project/picklescan"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/picklescan-arbitrary-code-execution-via-numpy-f2py-crackfortran-eval-length-gadget"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Picklescan is vulnerable to RCE through missing detection when calling numpy.f2py.crackfortran._eval_length"
}
GHSA-6569-3785-R3V6
Vulnerability from github – Published: 2024-12-18 06:30 – Updated: 2024-12-18 15:44Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "unisharp/laravel-filemanager"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-21546"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-12-18T15:44:45Z",
"nvd_published_at": "2024-12-18T06:15:22Z",
"severity": "HIGH"
},
"details": "Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file extension. This allows the attacker to execute malicious code.",
"id": "GHSA-6569-3785-r3v6",
"modified": "2024-12-18T15:44:45Z",
"published": "2024-12-18T06:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21546"
},
{
"type": "WEB",
"url": "https://github.com/UniSharp/laravel-filemanager/commit/8170760c0ae316d77b9363cd4c76ab68d3f63f0b"
},
{
"type": "WEB",
"url": "https://gist.github.com/ImHades101/338a06816ef97262ba632af9c78b78ca"
},
{
"type": "PACKAGE",
"url": "https://github.com/UniSharp/laravel-filemanager"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-PHP-UNISHARPLARAVELFILEMANAGER-7210316"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "UniSharp Laravel Filemanager Code Injection vulnerability"
}
GHSA-6577-HJ74-984X
Vulnerability from github – Published: 2024-06-12 15:31 – Updated: 2024-08-14 15:31Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects all versions of MegaBIP software.
{
"affected": [],
"aliases": [
"CVE-2024-1577"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-12T14:15:10Z",
"severity": "CRITICAL"
},
"details": "Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving\u00a0crafted by the attacker PHP code to one of the website files.\u00a0This issue affects all versions of MegaBIP software.",
"id": "GHSA-6577-hj74-984x",
"modified": "2024-08-14T15:31:11Z",
"published": "2024-06-12T15:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1577"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2024/06/CVE-2024-1576"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2024/06/CVE-2024-1576"
},
{
"type": "WEB",
"url": "https://megabip.pl"
},
{
"type": "WEB",
"url": "https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:D/RE:M/U:Amber",
"type": "CVSS_V4"
}
]
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.