NuProcess vulnerable to command-line injection through insertion of NUL character(s)
Published Sep 26, 2022
9.8
CRITICALCVSS 3.1
EPSS 1.56%
Description
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
Affected products
-
Affected
- ≥ 1.2.0, < 2.0.5
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Brettwooldridge | NuProcess | unknown | Affected
|
- ≥ 1.2.0 · < 2.0.5
Running on/with
- n/a
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (6)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6785 Advisory
- https://github.com/advisories/GHSA-cxgf-v2p8-7ph7 Advisory
- https://github.com/brettwooldridge/NuProcess/commit/29bc09de561bf00ff9bf77123756363a9709f868 x_refsource_MISCPatchThird Party Advisory
- https://github.com/brettwooldridge/NuProcess/pull/143 x_refsource_MISCExploitPatchThird Party Advisory
- https://github.com/brettwooldridge/NuProcess/security/advisories/GHSA-cxgf-v2p8-7ph7 x_refsource_CONFIRMThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-39243
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6785 | Advisory | |
| https://github.com/advisories/GHSA-cxgf-v2p8-7ph7 | Advisory | |
| https://github.com/brettwooldridge/NuProcess/commit/29bc09de561bf00ff9bf77123756363a9709f868 | x_refsource_MISCPatchThird Party Advisory | |
| https://github.com/brettwooldridge/NuProcess/pull/143 | x_refsource_MISCExploitPatchThird Party Advisory | |
| https://github.com/brettwooldridge/NuProcess/security/advisories/GHSA-cxgf-v2p8-7ph7 | x_refsource_CONFIRMThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-39243 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub