CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8342 vulnerabilities reference this CWE, most recent first.
GHSA-3F2J-57FF-R6P5
Vulnerability from github – Published: 2023-09-19 18:30 – Updated: 2023-09-19 18:30This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bitbucket Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bitbucket Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.5 Bitbucket Data Center and Server 8.10: Upgrade to a release greater than or equal to 8.10.5 Bitbucket Data Center and Server 8.11: Upgrade to a release greater than or equal to 8.11.4 Bitbucket Data Center and Server 8.12: Upgrade to a release greater than or equal to 8.12.2 Bitbucket Data Center and Server 8.13: Upgrade to a release greater than or equal to 8.13.1 Bitbucket Data Center and Server 8.14: Upgrade to a release greater than or equal to 8.14.0 Bitbucket Data Center and Server version >= 8.0 and < 8.9: Upgrade to any of the listed fix versions. See the release notes ([https://confluence.atlassian.com/bitbucketserver/release-notes]). You can download the latest version of Bitbucket Data Center and Server from the download center ([https://www.atlassian.com/software/bitbucket/download-archives]). This vulnerability was discovered by a private user and reported via our Bug Bounty program
{
"affected": [],
"aliases": [
"CVE-2023-22513"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-19T17:15:08Z",
"severity": "HIGH"
},
"details": "This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Bitbucket Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bitbucket Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.5 Bitbucket Data Center and Server 8.10: Upgrade to a release greater than or equal to 8.10.5 Bitbucket Data Center and Server 8.11: Upgrade to a release greater than or equal to 8.11.4 Bitbucket Data Center and Server 8.12: Upgrade to a release greater than or equal to 8.12.2 Bitbucket Data Center and Server 8.13: Upgrade to a release greater than or equal to 8.13.1 Bitbucket Data Center and Server 8.14: Upgrade to a release greater than or equal to 8.14.0 Bitbucket Data Center and Server version \u003e= 8.0 and \u003c 8.9: Upgrade to any of the listed fix versions. See the release notes ([https://confluence.atlassian.com/bitbucketserver/release-notes]). You can download the latest version of Bitbucket Data Center and Server from the download center ([https://www.atlassian.com/software/bitbucket/download-archives]). This vulnerability was discovered by a private user and reported via our Bug Bounty program",
"id": "GHSA-3f2j-57ff-r6p5",
"modified": "2023-09-19T18:30:16Z",
"published": "2023-09-19T18:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22513"
},
{
"type": "WEB",
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1283691616"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/BSERV-14419"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3F36-XGXJ-8G4Q
Vulnerability from github – Published: 2022-05-17 01:44 – Updated: 2022-05-17 01:44(1) AlbumTab.py, (2) ArtistTab.py, (3) LinksTab.py, and (4) LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory.
{
"affected": [],
"aliases": [
"CVE-2012-3355"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-07-17T21:55:00Z",
"severity": "LOW"
},
"details": "(1) AlbumTab.py, (2) ArtistTab.py, (3) LinksTab.py, and (4) LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory.",
"id": "GHSA-3f36-xgxj-8g4q",
"modified": "2022-05-17T01:44:04Z",
"published": "2022-05-17T01:44:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3355"
},
{
"type": "WEB",
"url": "https://bugzilla.gnome.org/show_bug.cgi?id=678661"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=835076"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/76538"
},
{
"type": "WEB",
"url": "https://hermes.opensuse.org/messages/15351848"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=616673"
},
{
"type": "WEB",
"url": "http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-3355.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/06/25/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/06/25/7"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/54186"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1503-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3F4X-WV57-P6JM
Vulnerability from github – Published: 2022-05-01 18:25 – Updated: 2022-05-01 18:25Format string vulnerability in the Cl_GetPackets function in cl_main.c in the client in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allows remote Doomsday servers to execute arbitrary code via format string specifiers in a PSV_CONSOLE_TEXT message.
{
"affected": [],
"aliases": [
"CVE-2007-4644"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-08-31T23:17:00Z",
"severity": "HIGH"
},
"details": "Format string vulnerability in the Cl_GetPackets function in cl_main.c in the client in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allows remote Doomsday servers to execute arbitrary code via format string specifiers in a PSV_CONSOLE_TEXT message.",
"id": "GHSA-3f4x-wv57-p6jm",
"modified": "2022-05-01T18:25:44Z",
"published": "2022-05-01T18:25:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4644"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36337"
},
{
"type": "WEB",
"url": "http://aluigi.org/poc/dumsdei.zip"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=190835"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26524"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28821"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200802-02.xml"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/3084"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/478077/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/25483"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3F5W-779W-6XPC
Vulnerability from github – Published: 2022-05-01 18:43 – Updated: 2022-05-01 18:43support/dispatch.cgi in SiteScape Forum allows remote attackers to execute arbitrary TCL code via code separator characters in the query string.
{
"affected": [],
"aliases": [
"CVE-2007-6515"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-12-21T22:46:00Z",
"severity": "HIGH"
},
"details": "support/dispatch.cgi in SiteScape Forum allows remote attackers to execute arbitrary TCL code via code separator characters in the query string.",
"id": "GHSA-3f5w-779w-6xpc",
"modified": "2022-05-01T18:43:43Z",
"published": "2022-05-01T18:43:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-6515"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39182"
},
{
"type": "WEB",
"url": "http://osvdb.org/39875"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28182"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/3480"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/15987"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/485398/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/26963"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3F5W-Q39V-GMMH
Vulnerability from github – Published: 2022-05-02 03:29 – Updated: 2022-05-02 03:29The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) js_LeaveSharpObject, (2) ParseXMLSource, and (3) a certain assertion in jsinterp.c; and other vectors.
{
"affected": [],
"aliases": [
"CVE-2009-1833"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-06-12T21:30:00Z",
"severity": "HIGH"
},
"details": "The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) js_LeaveSharpObject, (2) ParseXMLSource, and (3) a certain assertion in jsinterp.c; and other vectors.",
"id": "GHSA-3f5w-q39v-gmmh",
"modified": "2022-05-02T03:29:07Z",
"published": "2022-05-02T03:29:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1833"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=369696"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=426520"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=427196"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=487204"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=503570"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11487"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1095.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/55152"
},
{
"type": "WEB",
"url": "http://osvdb.org/55153"
},
{
"type": "WEB",
"url": "http://osvdb.org/55154"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1096.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35331"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35415"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35428"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35431"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35439"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35440"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35468"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35536"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35561"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35602"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1022376"
},
{
"type": "WEB",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.372468"
},
{
"type": "WEB",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.425408"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-265068-1"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020800.1-1"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1820"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:141"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2009/mfsa2009-24.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1125.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1126.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/35326"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/35372"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1022397"
},
{
"type": "WEB",
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.454275"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-782-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1572"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/2152"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3F63-HFP8-52JQ
Vulnerability from github – Published: 2024-01-19 21:30 – Updated: 2024-11-18 16:26Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Pillow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-50447"
],
"database_specific": {
"cwe_ids": [
"CWE-94",
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-22T21:28:18Z",
"nvd_published_at": "2024-01-19T20:15:11Z",
"severity": "CRITICAL"
},
"details": "Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).",
"id": "GHSA-3f63-hfp8-52jq",
"modified": "2024-11-18T16:26:35Z",
"published": "2024-01-19T21:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50447"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a"
},
{
"type": "WEB",
"url": "https://devhub.checkmarx.com/cve-details/CVE-2023-50447"
},
{
"type": "WEB",
"url": "https://duartecsantos.github.io/2023-01-02-CVE-2023-50447"
},
{
"type": "WEB",
"url": "https://duartecsantos.github.io/2024-01-02-CVE-2023-50447"
},
{
"type": "PACKAGE",
"url": "https://github.com/python-pillow/Pillow"
},
{
"type": "WEB",
"url": "https://github.com/python-pillow/Pillow/releases"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html"
},
{
"type": "WEB",
"url": "https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/20/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Arbitrary Code Execution in Pillow"
}
GHSA-3F63-W59M-X8FF
Vulnerability from github – Published: 2023-10-03 09:32 – Updated: 2023-11-02 12:30cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network.
{
"affected": [],
"aliases": [
"CVE-2023-3656"
],
"database_specific": {
"cwe_ids": [
"CWE-749",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-03T08:15:35Z",
"severity": "CRITICAL"
},
"details": "cashIT! - serving solutions. Devices from \"PoS/ Dienstleistung, Entwicklung \u0026 Vertrieb GmbH\" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network.",
"id": "GHSA-3f63-w59m-x8ff",
"modified": "2023-11-02T12:30:16Z",
"published": "2023-10-03T09:32:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3656"
},
{
"type": "WEB",
"url": "https://doi.org/10.35011/ww2q-d522"
},
{
"type": "WEB",
"url": "https://www.cashit.at"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3F7X-RF2Q-C7Q4
Vulnerability from github – Published: 2022-05-17 04:38 – Updated: 2025-04-12 12:36The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805.
{
"affected": [],
"aliases": [
"CVE-2014-5210"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-08-21T14:55:00Z",
"severity": "HIGH"
},
"details": "The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805.",
"id": "GHSA-3f7x-rf2q-c7q4",
"modified": "2025-04-12T12:36:46Z",
"published": "2022-05-17T04:38:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5210"
},
{
"type": "WEB",
"url": "http://forums.alienvault.com/discussion/2690"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/69239"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-14-294"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-14-295"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3F83-V3JG-8CF4
Vulnerability from github – Published: 2022-05-02 03:15 – Updated: 2022-05-02 03:15PHP remote file inclusion vulnerability in includes/header.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
{
"affected": [],
"aliases": [
"CVE-2009-0463"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-02-10T07:00:00Z",
"severity": "MODERATE"
},
"details": "PHP remote file inclusion vulnerability in includes/header.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.",
"id": "GHSA-3f83-v3jg-8cf4",
"modified": "2022-05-02T03:15:46Z",
"published": "2022-05-02T03:15:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0463"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/7954"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33649"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/33578"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3FC6-GF75-VVC3
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-08-17 00:00A vulnerability in the Cisco Adaptive Security Device Manager (ASDM) Launcher could allow an unauthenticated, remote attacker to execute arbitrary code on a user's operating system. This vulnerability is due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. An attacker could exploit this vulnerability by leveraging a man-in-the-middle position on the network to intercept the traffic between the Launcher and the ASDM and then inject arbitrary code. A successful exploit could allow the attacker to execute arbitrary code on the user's operating system with the level of privileges assigned to the ASDM Launcher. A successful exploit may require the attacker to perform a social engineering attack to persuade the user to initiate communication from the Launcher to the ASDM.
{
"affected": [],
"aliases": [
"CVE-2021-1585"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-08T19:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the Cisco Adaptive Security Device Manager (ASDM) Launcher could allow an unauthenticated, remote attacker to execute arbitrary code on a user\u0027s operating system. This vulnerability is due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. An attacker could exploit this vulnerability by leveraging a man-in-the-middle position on the network to intercept the traffic between the Launcher and the ASDM and then inject arbitrary code. A successful exploit could allow the attacker to execute arbitrary code on the user\u0027s operating system with the level of privileges assigned to the ASDM Launcher. A successful exploit may require the attacker to perform a social engineering attack to persuade the user to initiate communication from the Launcher to the ASDM.",
"id": "GHSA-3fc6-gf75-vvc3",
"modified": "2022-08-17T00:00:22Z",
"published": "2022-05-24T19:07:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1585"
},
{
"type": "WEB",
"url": "https://github.com/jbaines-r7/staystaystay"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asdm-rce-gqjShXW"
},
{
"type": "WEB",
"url": "https://www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.