CVE-2022-29583: OS Command injection in github.com/kardianos/service
Summary
GHSA-xm99-6pv5-q363: Disputed: OS Command injection in github.com/kardianos/service. Affects github.com/kardianos/service versions < 1.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/kardianos/service package for Go provides functionality for managing Windows services. It allows developers to create, start, stop, and manage services on Windows systems. However, a vulnerability has been discovered in the package that could lead to OS command injection.
Vulnerability Detail
The vulnerability exists in the service_windows.go file of the kardianos service package. It fails to properly quote the execution of a Windows service executable in certain scenarios. This omission can allow an attacker to inject malicious commands into the intended directory, potentially leading to unauthorized execution of arbitrary code. The validity of this vulnerability has been disputed, but caution should still be exercised.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a possible workaround is to manually apply proper quoting to the service executable in the affected code. Here is an example of how to do it:
cmd := exec.Command("cmd.exe", "/C", "\"path\to\service.exe\"")
Conclusion
In conclusion, the github.com/kardianos/service package for Go is vulnerable to an OS command injection issue. It is recommended to update the package to version 1.2.2 or later to mitigate the vulnerability. If immediate update is not possible, applying proper quoting to the service executable can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/kardianos/service →
FAQ
The vulnerability could allow an attacker to execute arbitrary commands on a Windows system, potentially leading to unauthorized access, data breaches, or other malicious activities.
Yes, the vulnerability affects Windows systems where the github.com/kardianos/service package is used.
The validity of this vulnerability has been disputed, but it is still recommended to take necessary precautions and update the package to the latest version.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is always advisable to address security vulnerabilities promptly.
For more information, you can refer to the GitHub advisory database entry at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-xm99-6pv5-q363/GHSA-xm99-6pv5-q363.json
