CVE-2022-24725 Exposure of home directory through shescape on Unix with Bash

2022-03-0321:35:10

CWE-200

GitHub_M

www.cve.org

cve-2022-24725

exposure

home directory

shescape

unix

bash

escape

vulnerability

CVSS3

6.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

49.0%

JSON

Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the escape or escapeAll functions from the shescape API with the interpolation option set to true. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of shescape is used, directory traversal may be possible in the application using shescape. The issue was patched in version 1.5.1. As a workaround, manually escape all instances of the tilde character (~) using arg.replace(/~/g, "\\~").

CNA Affected

[
  {
    "product": "shescape",
    "vendor": "ericcornelissen",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.4.0, < 1.5.1"
      }
    ]
  }
]