Executive brief
Shescape is a library used to safely escape command-line arguments when executing shell commands from Node.js applications. In versions prior to 1.5.8, the library fails to properly escape line feed characters when preparing arguments for Windows cmd.exe, allowing an attacker to inject newline characters that terminate the command early and drop all following arguments. This can be exploited to bypass intended command structure and execute unintended logic when processing user-controlled input.
Technical details
The vulnerability is an improper neutralization of escape/control sequences (CWE-74) affecting Shescape's cmd.exe escaping logic. The root cause is insufficient filtering of line feed characters ('\n') in the escape, escapeAll, quote, and quoteAll API functions when the shell option is set to "cmd.exe". An attacker can include a newline in user-supplied input that reaches these functions, causing cmd.exe to interpret it as a command separator, thereby truncating the intended command and omitting all arguments that follow. The vulnerability is network-reachable if user input is passed through Shescape to shell execution, with no authentication required. An attacker can achieve arbitrary command structure manipulation and argument injection/omission. The fix was released in version 1.5.8.
Affected products
- Eric Cornelissen Shescape prior to 1.5.8
Timeline
- 2022-07-15: disclosed
- 2022-07-15: patched: v1.5.8 released