Executive brief
shescape is a shell-escaping library for JavaScript used to safely pass untrusted data to shell commands. When the interpolation option is enabled on Unix systems running Bash, the library fails to properly escape the tilde character (~), allowing it to be expanded to the user's home directory path. An attacker who controls input strings containing "=~" or similar patterns can leak the home directory path or potentially achieve directory traversal if the output is used in file operations.
Technical details
shescape's escape() and escapeAll() functions fail to properly escape tilde characters in Bash when the interpolation option is enabled. Bash treats tilde expansion specially: a tilde at the end of an argument (e.g., "=~") or in patterns like "xxx:~", "~:xxx", or "xxx:~:xxx" following an equals sign will expand to the user's home directory path. The vulnerability occurs because shescape does not escape tildes in these contexts when interpolation is active, allowing an attacker-controlled string containing these patterns to leak the home directory pathname. While Dash and Zsh shells are not affected, applications using shescape with Bash on Unix systems are vulnerable. The issue was fixed in version 1.5.1. Applications using vulnerable versions with untrusted input in shell commands can mitigate by manually escaping tildes using `arg.replace(/~/g, "\\~")`.
Affected products
- ericcornelissen shescape >=1.4.0, <1.5.1
Timeline
- 2022-03-03: disclosed
- 2022-03-03: patched: Fixed in version 1.5.1