Executive brief
Shescape is a Node.js library that protects against shell injection attacks by escaping user input for various shells (PowerShell, CMD, etc.). On Windows systems, when Shescape is used in worker threads, it may incorrectly detect which shell is in use and apply the wrong escaping rules. An attacker can exploit this mismatch to bypass security protections and execute arbitrary shell commands.
Technical details
The vulnerability is an improper neutralization of escape sequences (CWE-150) affecting Shescape's shell detection logic on Windows. When Shescape runs in a worker thread context, environment variable name changes on Windows cause the library to fail to detect the configured shell (e.g., PowerShell) and fall back to a default shell (e.g., CMD), resulting in incorrect escaping rules being applied. An attacker can craft input that bypasses the escaping intended for one shell but executes as a command in another. This affects versions prior to 1.7.4. The vulnerability requires the application to use Shescape in a threaded context on Windows with a mismatch between the expected and detected shell. A patch is available in version 1.7.4 with no known workarounds for affected versions.
Affected products
- Eric Cornelissen Shescape <1.7.4
Timeline
- 2023-08-22: disclosed
- 2023-08-22: patched: Patched in version 1.7.4