CVE-2022-24725: shescape - Exposure of home directory through shescape on Unix with Bash
Summary
CVE-2022-24725: Exposure of home directory through shescape on Unix with Bash. Affects shescape versions >= 1.4.0, < 1.5.1. Fixed in 1.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
shescape is an npm package that provides a set of functions for escaping special characters in shell commands. It is commonly used in Unix systems with Bash to ensure the safe execution of shell commands. However, a vulnerability has been discovered in shescape that can lead to the exposure of the home directory on Unix systems when using the escape or escapeAll functions with the interpolation option set to true. This vulnerability does not affect other tested shells like Dash and Zsh.
Vulnerability Detail
The vulnerability in shescape arises from the improper handling of the tilde character (~) when the interpolation option is enabled. By crafting a payload with the home_directory=~ string and using the escape or escapeAll functions with the interpolation option set to true, an attacker can cause the home directory to be exposed. Depending on how the output of shescape is used, this can potentially lead to directory traversal attacks in the application using shescape.
How To Fix
Minimum fixed version
1.5.1
This is the first release that contains the fix.
npm install shescape@1.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the shescape dependency is not immediately feasible, a temporary workaround is to manually escape all instances of the tilde character (~) using the replace method. For example, developers can use the following code snippet to replace all tildes with \~: arg.replace(/~/g, '\\~'). This workaround should be applied to any code that uses the escape or escapeAll functions with the interpolation option set to true.
Conclusion
The vulnerability in shescape that exposes the home directory on Unix systems has been described. It is important for developers to update their shescape dependency to version 1.5.1 or higher to mitigate the vulnerability. If immediate updating is not possible, the provided workaround can be used. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for shescape →
FAQ
shescape is an npm package that provides functions for escaping special characters in shell commands. It is commonly used in Unix systems with Bash.
The vulnerability allows for the exposure of the home directory on Unix systems when using shescape with the interpolation option set to true. This can potentially lead to directory traversal attacks in the application using shescape.
Only Bash is affected by this vulnerability. Other tested shells like Dash and Zsh are not affected.
Yes, the vulnerability has been patched in version 1.5.1 of shescape. It is recommended to update to the latest version to mitigate the vulnerability.
Yes, a temporary workaround is to manually escape all instances of the tilde character (~) using the replace method. This should be done for any code that uses the affected functions with the interpolation option set to true.
References
Related vulnerabilities
Recent vulnerabilities recorded for shescape.
