CVE-2022-31180: Shescape Shescape Vulnerable To Insufficient Escaping Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-44vr-rwwj-p88h",
  "modified" : "2022-08-11T22:14:40Z",
  "published" : "2022-07-15T21:46:08Z",
  "aliases" : [ "CVE-2022-31180" ],
  "summary" : "Shescape vulnerable to insufficient escaping of whitespace",
  "details" : "### Impact\n\nThis only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. Example:\n\n```javascript\nimport cp from \"node:child_process\";\nimport * as shescape from \"shescape\";\n\n// 1. Prerequisites\nconst options = {\n  shell: \"bash\",\n  // Or\n  shell: \"dash\",\n  // Or\n  shell: \"powershell.exe\",\n  // Or\n  shell: \"zsh\",\n  // Or\n  shell: undefined, // Only if the default shell is one of the affected shells.\n};\n\n// 2. Attack (one of multiple)\nconst payload = \"foo #bar\";\n\n// 3. Usage\nlet escapedPayload;\nshescape.escape(payload, { interpolation: true });\n// Or\nshescape.escapeAll(payload, { interpolation: true });\n\ncp.execSync(`echo Hello ${escapedPayload}!`, options);\n// _Output depends on the shell being used_\n```\n\nThe result is that if an attacker is able to include whitespace in their input they can:\n\n1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace.\n   - Affected shells: _Bash_, _Dash_, _Zsh_, _PowerShell_\n2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. \n   - Affected shells: _Bash_\n3. Invoke arbitrary commands by inserting a line feed character.\n   - Affected Shells: _Bash_, _Dash_, _Zsh_, _PowerShell_\n3. Invoke arbitrary commands by inserting a carriage return character.\n   - Affected Shells: _PowerShell_\n\n### Patches\n\nBehaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required.\n\nBehaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required.\n\n### Workarounds\n\nThe best workaround is to avoid having to use the `interpolation: true` option - in most cases using an alternative is possible, see [the recipes](https://github.com/ericcornelissen/shescape#recipes) for recommendations.\n\nAlternatively, you can strip all whitespace from user input. Note that this is error prone, for example: for PowerShell this requires stripping `'\\u0085'` which is not included in JavaScript's definition of `\\s` for Regular Expressions.\n\n### References\n\n- https://github.com/ericcornelissen/shescape/pull/322\n- https://github.com/ericcornelissen/shescape/pull/324\n- https://github.com/ericcornelissen/shescape/pull/332\n- https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7\n- https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8\n\n### For more information\n\n- Comment on:\n  - For behaviour 1 (PowerShell): https://github.com/ericcornelissen/shescape/pull/322\n  - For behaviour 1 (Bash, Dash, Zsh): https://github.com/ericcornelissen/shescape/pull/324\n  - For behaviour 2, 3, 4 (_any shell_): https://github.com/ericcornelissen/shescape/pull/332\n- Open an issue at https://github.com/ericcornelissen/shescape/issues (_New issue_ > _Question_ > _Get started_)\n- If you're missing CMD from this advisory, see https://github.com/ericcornelissen/shescape/security/advisories/GHSA-jjc5-fp7p-6f8w\n\n[v1.5.7]: https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7\n[v1.5.8]: https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8\n\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "shescape"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.4.0"
      }, {
        "fixed" : "1.5.8"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ericcornelissen/shescape/security/advisories/GHSA-44vr-rwwj-p88h"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-31180"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ericcornelissen/shescape/pull/322"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ericcornelissen/shescape/pull/324"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ericcornelissen/shescape/pull/332"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ericcornelissen/shescape"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ericcornelissen/shescape/releases/tag/v1.5.7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ericcornelissen/shescape/releases/tag/v1.5.8"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-74" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-07-15T21:46:08Z",
    "nvd_published_at" : "2022-08-01T20:15:00Z"
  }
}