Junglewise Threat Intelligence

CVE-2022-31180: Shescape insufficient escaping of whitespace in interpolation mode

CVE-2022-31180 · Severity: low · CVSS 3.1 · Published 2022-07-15

Technologies: shescape (npm). Vendors: npm.

Executive brief

Shescape is a Node.js library that sanitizes user input for safe shell command execution. When using the interpolation mode feature, the library fails to properly escape whitespace characters, allowing attackers to inject shell commands. An attacker who can control input to an application using this library with interpolation enabled can execute arbitrary commands with the privileges of the application.

Technical details

Shescape's escape() and escapeAll() functions with the interpolation option enabled fail to neutralize control sequences after whitespace characters. The vulnerability allows attackers to inject shell-specific metacharacters after whitespace (e.g., "#" for comments), line feed and carriage return characters to execute arbitrary commands. This affects Bash, Dash, Zsh, and PowerShell. The vulnerability requires that the application be using interpolation mode and that user-controlled input reaches the vulnerable escaping functions. Patches were released in versions 1.5.7 (partial fix) and 1.5.8 (complete fix). Workarounds include avoiding interpolation mode where possible or stripping whitespace from user input, though the latter approach is error-prone.

Affected products

  • ericcornelissen shescape >=1.4.0 <1.5.8

Timeline

  • 2022-07-15: disclosed
  • 2022-07-06: patched: Partial patch in v1.5.7
  • 2022-07-15: patched: Complete patch in v1.5.8

References

Related threats