Description

Withdrawn Advisory: Shescape has possible misidentification of shell due to link chains

Withdrawn Advisory

This advisory has been withdrawn because it falls outside the https://github.com/ericcornelissen/shescape/blob/a2544a1c78cae19d0e81a485b997bf0b0fcc2c12/SECURITY.md#threat-model. This link is maintained to preserve external references.

Original Description

Impact

This impacts users of Shescape that configure their shell to point to a file on disk that is a link to a link. The precise result of being affected depends on the actual shell used and incorrect shell identified by Shescape.

In particular, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information, consider the following proof of concept (targeting Shescape v2):

import fs from "node:fs";
import { exec } from "node:child_process";

import { Shescape } from "shescape";
import which from "which";

/* 1. Set up */
const shell = which.sync("bash");...
Show more

Patches

This problem has been patched in v2.1.9 which you can upgrade to now.

Workarounds

If upgrading is not an option, either avoid using a shell or make sure the shell path you use is not a link to a link.

References

Shescape Pull Request #2388

Shescape Release v2.1.9

For more information

Comment on Pull Request #2388

Open an issue at https://github.com/ericcornelissen/shescape/issues (New issue > Question)

Mitigation

Aliases

References