[MSHARED-297] Commandline class shell injection vulnerabilities

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: maven-shared-utils-3.3.3
• Component/s: maven-shared-utils
• Labels: SECURITY
• External issue URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29599
• Assignee: Sylwester Lachiewicz
• Reporter: Charles Duffy
• Created: 23/Oct/13 19:49
• Updated: 23/May/22 17:52
• Resolved: 20/Jul/20 15:47

Description

The Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

The BourneShell class should unconditionally single-quote emitted strings (including the name of the command itself being quoted), with '"'"' used for embedded single quotes, for maximum safety across shells implementing a superset of POSIX quoting rules.

An appropriate fix has been built and applied against PLXUTILS; that patch is submitted here in the hope that it will be useful, though it is not expected to apply to the maven-shared-utils codebase without modification.

See PLXUTILS-161 for history/discussion.

Issue Links

• relates to: MSHARED-431 # (Hash-Sign) should trigger quoting in BourneShell.java
• links to: GitHub Pull Request #40