Impact
This impact users of Shescape:
- On Windows using the Windows Command Prompt (i.e.
cmd.exe
), and
- Using
quote
/quoteAll
or escape
/escapeAll
with the interpolation
option set to true
.
An attacker may be able to get read-only access to environment variables. Example:
import * as cp from "node:child_process";
import * as shescape from "shescape";
// 1. Prerequisites
const options = {
shell: "cmd.exe",
// Or
shell: undefined, // Only if the default shell is CMD
// And
interpolation: true, // Only applies to `escape` and `escapeAll` usage
}
// 2. Attack (one of many)
const payload = "%PATH%";
// 3. Usage
let escapedPayload;
escapedPayload = shescape.quote(payload, options);
// Or
escapedPayload = shescape.quoteAll([payload], options);
// Or
escapedPayload = shescape.escape(payload, options);
// Or
escapedPayload = shescape.escapeAll([payload], options);
// And (example)
const result = cp.execSync(`echo Hello ${escapedPayload}`, options);
// 4. Impact
console.log(result.toString());
// Outputs "Hello" followed by the contents of the PATH environment variable
Patches
This bug has been patched in v1.7.1 which you can upgrade to now. No further changes are required.
Workarounds
Alternatively, users can remove all instances of %
from user input, either before or after using Shescape.
References
Impact
This impact users of Shescape:
cmd.exe
), andquote
/quoteAll
orescape
/escapeAll
with theinterpolation
option set totrue
.An attacker may be able to get read-only access to environment variables. Example:
Patches
This bug has been patched in v1.7.1 which you can upgrade to now. No further changes are required.
Workarounds
Alternatively, users can remove all instances of
%
from user input, either before or after using Shescape.References
d0fce70