Is CVE-2023-40185 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-40185 being exploited in the wild.

How severe is CVE-2023-40185?

Low severity, with a CVSS score of 3.1, published 22 August 2023.

Which products and versions are affected?

shescape (npm) SEMVER:introduced=0,fixed=1.7.4.

Is there a fix for CVE-2023-40185?

Yes. shescape (npm): upgrade to 1.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-40185 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-40185?

Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-40185: Shescape shell escaping bypass in threaded context on Windows

CVE-2023-40185 · Severity: low · CVSS 3.1 · Published 2023-08-22

Shescape is a Node.js library that protects against shell injection attacks by escaping user input for various shells (PowerShell, CMD, etc.). On Windows systems, when Shescape is used in worker threads, it may incorrectly detect which shell is in use and apply the wrong escaping rules. An attacker can exploit this mismatch to bypass security protections and execute arbitrary shell commands.

Technologies: shescape (npm). Vendors: npm.

Quick answers

Is CVE-2023-40185 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-40185 being exploited in the wild.
How severe is CVE-2023-40185?: Low severity, with a CVSS score of 3.1, published 22 August 2023.
Which products and versions are affected?: shescape (npm) SEMVER:introduced=0,fixed=1.7.4.
Is there a fix for CVE-2023-40185?: Yes. shescape (npm): upgrade to 1.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-40185 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-40185?: Check whether you run shescape (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

shescape (npm): upgrade to 1.7.4 or later
```
npm install shescape@1.7.4
```

Technical details

The vulnerability is an improper neutralization of escape sequences (CWE-150) affecting Shescape's shell detection logic on Windows. When Shescape runs in a worker thread context, environment variable name changes on Windows cause the library to fail to detect the configured shell (e.g., PowerShell) and fall back to a default shell (e.g., CMD), resulting in incorrect escaping rules being applied. An attacker can craft input that bypasses the escaping intended for one shell but executes as a command in another. This affects versions prior to 1.7.4. The vulnerability requires the application to use Shescape in a threaded context on Windows with a mismatch between the expected and detected shell. A patch is available in version 1.7.4 with no known workarounds for affected versions.

Affected products

Eric Cornelissen Shescape <1.7.4

Identifiers

CVE-2023-40185
GHSA-j55r-787p-m549

Timeline

2023-08-22: disclosed
2023-08-22: patched: Patched in version 1.7.4

References

https://github.com/ericcornelissen/shescape/security/advisories/GHSA-j55r-787p-m549

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.