CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8377 vulnerabilities reference this CWE, most recent first.
GHSA-4VV7-JJ25-4GH6
Vulnerability from github – Published: 2026-07-24 16:12 – Updated: 2026-07-24 16:12Summary
Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value
raw, with no identifier or path sanitization, as both the generated client's class/namespace name
and part of the generated output path. When kiota generate is run without -c/--class-name — the
zero-config workflow that x-ms-kiota-info is explicitly designed for (the API provider supplies the names in
the description so consumers don't have to) — an attacker who controls or tampers with the OpenAPI description
could therefore:
- (CWE-22) write the generated source file to a path outside the
-ooutput directory — e.g.clientClassName: "/var/www/html/shell"; and - (CWE-94) inject arbitrary text into the generated class/namespace declaration, corrupting the generated client.
Confirmed on Kiota 1.32.4 (the self-contained linux-x64 release binary), i.e. after the earlier
writer-sink hardening — that fix escaped property/enum/default/serialization sinks but never sanitized the
provider-supplied clientClassName / clientNamespaceName.
Details
clientClassName reached two unsanitized sinks (observed in the generated C#; the same raw emission occurred
for Java, Go, TypeScript, Python, and PHP):
# output FILENAME (CWE-22): clientClassName flows into the file path
clientClassName: "/abs/path/PWNED" -> /abs/path/PWNED.cs (written outside -o)
# class declaration (CWE-94): clientClassName flows verbatim into the type declaration
clientClassName: 'Pwn { } public class INJECTED { } public partial class RealClient'
-> public partial class Pwn { } public class INJECTED { } public partial class RealClient : ... { }
clientNamespaceName reached the analogous namespace/path sinks.
Impact
A developer or CI host generating a client from an attacker-controlled or compromised OpenAPI description
(without -c) could create/overwrite a generated source file at an attacker-influenced path and emit
attacker-controlled text into the generated client.
This does not reach clean remote code execution: because clientClassName is reused verbatim at multiple
sites (the class name and the constructor name), injected code cannot be made to compile — it breaks the
build. So the code-injection vector is a generation/build-corruption (integrity/DoS), and the high-severity
primitive is the file write. CWE-22 / CWE-94.
Patches
Fixed in 1.32.5 (https://github.com/microsoft/kiota/pull/7884). clientClassName and
clientNamespaceName sourced from x-ms-kiota-info are now sanitized before use:
GenerationConfiguration.SanitizeClientClassName strips any character outside [A-Za-z0-9_] and any invalid
leading character (falling back to ApiClient), and SanitizeClientNamespaceName restricts to
[A-Za-z0-9._-], collapses consecutive dots, strips invalid leading characters (falling back to ApiSdk).
This removes path separators, drive/colon, .., quotes, and braces, so the values can no longer influence
the output path or inject into the declaration.
Remediation
Upgrade to Kiota 1.32.5 or later and regenerate affected clients.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.OpenApi.Kiota"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.32.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.OpenApi.Kiota.Builder"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.32.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59866"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T16:12:14Z",
"nvd_published_at": "2026-07-16T16:19:15Z",
"severity": "HIGH"
},
"details": "### Summary\n\nMicrosoft Kiota emitted the `x-ms-kiota-info` extension\u0027s `clientClassName` or `clientNamespaceName` value\n**raw**, with no identifier or path sanitization, as **both** the generated client\u0027s class/namespace name\n**and** part of the generated output path. When `kiota generate` is run **without `-c/--class-name`** \u2014 the\nzero-config workflow that `x-ms-kiota-info` is explicitly designed for (the API provider supplies the names in\nthe description so consumers don\u0027t have to) \u2014 an attacker who controls or tampers with the OpenAPI description\ncould therefore:\n\n- **(CWE-22) write the generated source file to a path outside the `-o` output directory** \u2014 e.g.\n `clientClassName: \"/var/www/html/shell\"`; and\n- **(CWE-94) inject arbitrary text into the generated class/namespace declaration**, corrupting the generated\n client.\n\nConfirmed on Kiota **1.32.4** (the self-contained `linux-x64` release binary), i.e. **after** the earlier\nwriter-sink hardening \u2014 that fix escaped property/enum/default/serialization sinks but never sanitized the\nprovider-supplied `clientClassName` / `clientNamespaceName`.\n\n### Details\n\n`clientClassName` reached two unsanitized sinks (observed in the generated C#; the same raw emission occurred\nfor Java, Go, TypeScript, Python, and PHP):\n\n```\n# output FILENAME (CWE-22): clientClassName flows into the file path\nclientClassName: \"/abs/path/PWNED\" -\u003e /abs/path/PWNED.cs (written outside -o)\n\n# class declaration (CWE-94): clientClassName flows verbatim into the type declaration\nclientClassName: \u0027Pwn { } public class INJECTED { } public partial class RealClient\u0027\n -\u003e public partial class Pwn { } public class INJECTED { } public partial class RealClient : ... { }\n```\n\n`clientNamespaceName` reached the analogous namespace/path sinks.\n\n### Impact\n\nA developer or CI host generating a client from an attacker-controlled or compromised OpenAPI description\n(without `-c`) could create/overwrite a generated source file at an attacker-influenced path and emit\nattacker-controlled text into the generated client.\n\nThis does **not** reach clean remote code execution: because `clientClassName` is reused verbatim at multiple\nsites (the class name **and** the constructor name), injected code cannot be made to compile \u2014 it breaks the\nbuild. So the code-injection vector is a generation/build-corruption (integrity/DoS), and the high-severity\nprimitive is the file write. CWE-22 / CWE-94.\n\n### Patches\n\nFixed in **1.32.5** (https://github.com/microsoft/kiota/pull/7884). `clientClassName` and\n`clientNamespaceName` sourced from `x-ms-kiota-info` are now sanitized before use:\n`GenerationConfiguration.SanitizeClientClassName` strips any character outside `[A-Za-z0-9_]` and any invalid\nleading character (falling back to `ApiClient`), and `SanitizeClientNamespaceName` restricts to\n`[A-Za-z0-9._-]`, collapses consecutive dots, strips invalid leading characters (falling back to `ApiSdk`).\nThis removes path separators, drive/colon, `..`, quotes, and braces, so the values can no longer influence\nthe output path or inject into the declaration.\n\n### Remediation\n\nUpgrade to Kiota **1.32.5** or later and regenerate affected clients.",
"id": "GHSA-4vv7-jj25-4gh6",
"modified": "2026-07-24T16:12:14Z",
"published": "2026-07-24T16:12:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/microsoft/kiota/security/advisories/GHSA-4vv7-jj25-4gh6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59866"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/kiota/pull/7884"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/kiota/commit/dc812dbbf88ef7edf53a890d36b2f9d1460e947d"
},
{
"type": "PACKAGE",
"url": "https://github.com/microsoft/kiota"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/kiota/releases/tag/v1.32.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName"
}
GHSA-4VVF-Q5VQ-FM6W
Vulnerability from github – Published: 2025-04-22 18:32 – Updated: 2025-04-22 18:32NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.
{
"affected": [],
"aliases": [
"CVE-2025-23251"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-22T16:15:44Z",
"severity": "HIGH"
},
"details": "NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.",
"id": "GHSA-4vvf-q5vq-fm6w",
"modified": "2025-04-22T18:32:11Z",
"published": "2025-04-22T18:32:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23251"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5641"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4W2J-2RG4-5MJW
Vulnerability from github – Published: 2022-12-21 06:30 – Updated: 2022-12-22 03:33The package vm2 before 3.9.10 is vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "vm2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25893"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-22T03:33:42Z",
"nvd_published_at": "2022-12-21T05:15:00Z",
"severity": "CRITICAL"
},
"details": "The package vm2 before 3.9.10 is vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.",
"id": "GHSA-4w2j-2rg4-5mjw",
"modified": "2022-12-22T03:33:42Z",
"published": "2022-12-21T06:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25893"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/issues/444"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/pull/445"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69"
},
{
"type": "PACKAGE",
"url": "https://github.com/patriksimek/vm2"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-VM2-2990237"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "vm2 vulnerable to Arbitrary Code Execution"
}
GHSA-4W64-J7CG-53XC
Vulnerability from github – Published: 2023-04-24 21:30 – Updated: 2023-04-24 21:30Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
{
"affected": [],
"aliases": [
"CVE-2023-2259"
],
"database_specific": {
"cwe_ids": [
"CWE-1336",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-24T21:15:09Z",
"severity": "CRITICAL"
},
"details": "Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.",
"id": "GHSA-4w64-j7cg-53xc",
"modified": "2023-04-24T21:30:30Z",
"published": "2023-04-24T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2259"
},
{
"type": "WEB",
"url": "https://github.com/alfio-event/alf.io/commit/94e2923a317452e337393789c9f3192dfc1ddac2"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/e753bce0-ce82-463b-b344-2f67b39b60ff"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4W67-4RR6-54CG
Vulnerability from github – Published: 2022-05-02 03:56 – Updated: 2022-05-02 03:56PHP remote file inclusion vulnerability in admin/admin_news_bot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter, a different vector than CVE-2007-0572.
{
"affected": [],
"aliases": [
"CVE-2009-4622"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-01-18T20:30:00Z",
"severity": "HIGH"
},
"details": "PHP remote file inclusion vulnerability in admin/admin_news_bot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter, a different vector than CVE-2007-0572.",
"id": "GHSA-4w67-4rr6-54cg",
"modified": "2022-05-02T03:56:33Z",
"published": "2022-05-02T03:56:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4622"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53136"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/9635"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4W69-XG22-FCCQ
Vulnerability from github – Published: 2022-05-13 01:09 – Updated: 2025-04-20 03:35Cloud Foundry Foundation BOSH Azure CPI v22 could potentially allow a maliciously crafted stemcell to execute arbitrary code on VMs created by the director, aka a "CPI code injection vulnerability."
{
"affected": [],
"aliases": [
"CVE-2017-4964"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-06T19:59:00Z",
"severity": "HIGH"
},
"details": "Cloud Foundry Foundation BOSH Azure CPI v22 could potentially allow a maliciously crafted stemcell to execute arbitrary code on VMs created by the director, aka a \"CPI code injection vulnerability.\"",
"id": "GHSA-4w69-xg22-fccq",
"modified": "2025-04-20T03:35:30Z",
"published": "2022-05-13T01:09:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-4964"
},
{
"type": "WEB",
"url": "https://www.cloudfoundry.org/cve-2017-4964"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4W73-RC2P-P6JP
Vulnerability from github – Published: 2022-05-05 00:00 – Updated: 2022-05-13 00:01Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php.
{
"affected": [],
"aliases": [
"CVE-2022-28096"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-04T13:15:00Z",
"severity": "HIGH"
},
"details": "Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php.",
"id": "GHSA-4w73-rc2p-p6jp",
"modified": "2022-05-13T00:01:07Z",
"published": "2022-05-05T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28096"
},
{
"type": "WEB",
"url": "https://github.com/zorlan/skycaiji/issues/39"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4W88-RJJ3-X7WP
Vulnerability from github – Published: 2018-07-24 20:04 – Updated: 2023-09-13 19:15Affected versions of ElectronJS are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the sandbox option is enabled.
Recommendation
Update to electron version 1.7.8 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "electron"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "electron"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-16151"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:59:23Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "Affected versions of `ElectronJS` are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.\n\n\n\n## Recommendation\n\nUpdate to electron version 1.7.8 or later.",
"id": "GHSA-4w88-rjj3-x7wp",
"modified": "2023-09-13T19:15:15Z",
"published": "2018-07-24T20:04:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16151"
},
{
"type": "WEB",
"url": "https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix"
},
{
"type": "WEB",
"url": "https://electronjs.org/blog/chromium-rce-vulnerability"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-4w88-rjj3-x7wp"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/539"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Chromium Remote Code Execution in electron"
}
GHSA-4W8R-3XRW-V25G
Vulnerability from github – Published: 2023-09-13 15:44 – Updated: 2023-12-22 19:42Impact
This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue.
Mitigations
- This has been fixed in Craft 4.4.15. You should ensure you’re running at least that version.
- Refresh your security key in case it has already been captured. You can do that by running the
php craft setup/security-keycommand and copying the updatedCRAFT_SECURITY_KEYenvironment variable to all production environments. - If you have any other private keys stored as environment variables (e.g., S3 or Stripe), refresh those as well.
- Out of an abundance of caution, you may want to force all your users to reset their passwords in case your database was compromised. You can do that by running
php craft resave/users --set passwordResetRequired --to "fn() => true".
References
https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476
https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857
https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.4.14"
},
"package": {
"ecosystem": "Packagist",
"name": "craftcms/cms"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-RC1"
},
{
"fixed": "4.4.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-41892"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-13T15:44:09Z",
"nvd_published_at": "2023-09-13T20:15:08Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nThis is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. \n\n### Mitigations\n\n* This has been fixed in Craft 4.4.15. You should ensure you\u2019re running at least that version.\n* Refresh your security key in case it has already been captured. You can do that by running the `php craft setup/security-key` command and copying the updated `CRAFT_SECURITY_KEY` environment variable to all production environments.\n* If you have any other private keys stored as environment variables (e.g., S3 or Stripe), refresh those as well.\n* Out of an abundance of caution, you may want to force all your users to reset their passwords in case your database was compromised. You can do that by running `php craft resave/users --set passwordResetRequired --to \"fn() =\u003e true\"`.\n\n### References\n\nhttps://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476\n\nhttps://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857\n\nhttps://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e\n\nhttps://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical\n",
"id": "GHSA-4w8r-3xrw-v25g",
"modified": "2023-12-22T19:42:51Z",
"published": "2023-09-13T15:44:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41892"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/cms"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/176303/Craft-CMS-4.4.14-Remote-Code-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Craft CMS Remote Code Execution vulnerability"
}
GHSA-4WF2-8957-VF9X
Vulnerability from github – Published: 2022-05-02 03:42 – Updated: 2022-05-02 03:42Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel SxView Memory Corruption Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2009-3128"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-11-11T19:30:00Z",
"severity": "HIGH"
},
"details": "Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka \"Excel SxView Memory Corruption Vulnerability.\"",
"id": "GHSA-4wf2-8957-vf9x",
"modified": "2022-05-02T03:42:06Z",
"published": "2022-05-02T03:42:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3128"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6474"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1023157"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA09-314A.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.