CVE-2021-41862: Expression Injection in AviatorScript
Summary
CVE-2021-41862: Expression injection in AviatorScript. Affects com.googlecode.aviator:aviator versions >= 5.2.1, <= 5.2.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AviatorScript is a scripting language that allows users to execute expressions in Java applications. It is commonly used for mathematical calculations, data manipulation, and business rule evaluation. AviatorScript versions up to 5.2.7 are affected by a critical vulnerability that enables code execution through an expression encoded with the Byte Code Engineering Library (BCEL). This vulnerability poses a significant risk to applications utilizing AviatorScript, as it allows attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability in AviatorScript arises from the improper handling of expressions encoded with BCEL. By crafting a malicious expression and encoding it with BCEL, an attacker can inject arbitrary code into the application. This code will be executed when the expression is evaluated, leading to potential remote code execution, data manipulation, or unauthorized access. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to AviatorScript version 5.2.8 or later.
Conclusion
AviatorScript versions up to 5.2.7 are vulnerable to expression injection, which allows attackers to execute arbitrary code. To mitigate this risk, it is essential to upgrade to AviatorScript version 5.2.8 or later. Developers should also review and validate user-supplied expressions to prevent code injection attacks. For further assistance with vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.googlecode.aviator:aviator →
FAQ
AviatorScript is a scripting language used for executing expressions in Java applications. It provides a concise syntax for mathematical calculations, data manipulation, and business rule evaluation.
This vulnerability allows attackers to execute arbitrary code in applications using AviatorScript. It can lead to remote code execution, data manipulation, or unauthorized access.
To fix this vulnerability, upgrade AviatorScript to version 5.2.8 or later. Ensure that your Maven dependencies are updated to use the patched version.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading AviatorScript.
This vulnerability is rated as critical with a CVSS score of 9.8.
