CVE-2017-1000487: OS Command Injection in Plexus-utils
Summary
CVE-2017-1000487: OS Command Injection in Plexus-utils. Affects org.codehaus.plexus:plexus-utils versions < 3.0.16. Fixed in 3.0.16. How to fix ↓
Also tracked for
- plexus-utils2 · Debian:11
The same CVE-2017-1000487 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plexus-utils is a Maven ecosystem package that provides various utility classes for the development and execution of Java applications. It is commonly used for tasks such as file manipulation, system interaction, and command execution. However, versions prior to 3.0.16 are vulnerable to OS command injection due to improper handling of double quoted strings.
Vulnerability Detail
The vulnerability in Plexus-utils allows an attacker to inject arbitrary commands into the application's command execution functionality. By manipulating the contents of double quoted strings, an attacker can execute malicious commands on the underlying operating system. This can lead to unauthorized access, data leakage, and potential compromise of the entire system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 4.1.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to sanitize user input and ensure that any double quoted strings are properly escaped or avoided altogether. This can be achieved by using appropriate input validation and sanitization techniques. Here is an example of how to sanitize user input in Java:
String sanitizedInput = input.replace("\"", "\\\"");
Conclusion
In conclusion, Plexus-utils versions prior to 3.0.16 are vulnerable to OS command injection, which can lead to unauthorized access and potential compromise of the system. It is crucial to upgrade to the latest version of Plexus-utils or apply the provided workaround to mitigate this vulnerability. Regularly monitoring and patching open-source vulnerabilities is essential for maintaining the security of your software.
See every vulnerability recorded for org.codehaus.plexus:plexus-utils →
FAQ
Plexus-utils is a utility package in the Maven ecosystem that provides various helper classes for Java development, including file manipulation, system interaction, and command execution.
OS command injection is a type of vulnerability where an attacker can execute arbitrary commands on the underlying operating system by injecting malicious input into a command execution function.
This vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system. An attacker could execute arbitrary commands with the privileges of the application, potentially gaining full control over the system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your pom.xml file and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
For further support on vulnerability remediation and assistance in securing your application, you can reach out to info@devnack.com. Our team of experts will be happy to assist you.
Related vulnerabilities
Recent vulnerabilities recorded for org.codehaus.plexus:plexus-utils.
