BF Specification of CVE-2023-2564 — OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.

../../../../BF/images/BFVUL/BFCVE-2023-2564(simple)-0.png
Missing Code (in '_format(value)') to Sanitize (arrays of strings) of Entered data (via API via '/preview' or '/scan' POST endpoint) using Denylist mechanism ((the characters '$', ' ', '#', '\\', or ';')) in Codebase source code (packages/server/src/classes/command-builder.js#L21) in Local execution space leads to Command Injection ((OS Command Injection)) final error, which can be exploited toward Arbitrary Code Execution (ACE) (everything could be lost) security failure.



vendor:product: scanservjs_project:scanservjs


Bug Report


Code with Fix


Code with Bug


NVD Entry

ClassDefinition
DVLData Validation (DVL) class – Data are validated (i.e., syntax check) or sanitized (i.e., escape, filter, or repair) improperly.
OperationDefinition
SanitizeSanitize operation – Modify data (e.g., escape/neutralize, filter/remove, or repair/add symbols or elements) to make it valid (well-formed).
Cause/ConsequenceDefinition
Code BugCode Bug type – An error in the implementation of an operation – proper operands over an improper operation. It is the roor cause of a security vulnerability. Must be fixed to resolve the vulnerability.
   Missing CodeMissing Code bug - The operation is misplaced entirely absent.
Injection Final ErrorInjection final error/exploit vector type – An exploitable or undefined system behavior caused by validation or sanitization bugs.
   Command InjectionCommand Injection final error – Maliciously inserted new commands into the input to a command sent to an OS, a server, or an AI model.
Operation AttributeDefinition
MechanismMechanism operation attribute type – Shows how the operation with a bug or faulty operand is performed.
   DenylistDenylist operation attribute – The operation is via a policy based on a set of known bad content; helps reject outright maliciously malformed data.
Source CodeSource Code operation attribute type – Shows where the code of the operation with a bug or faulty operand resides within the software, firmware, or hardware.
   CodebaseCodebase operation attribute – The operation is in the programmer's code - in the application itself.
Execution SpaceExecution Space operation attribute type – Shows where the operation with a bug or faulty operand is executed and the privilege level at which it runs.
   LocalLocal operation attribute – The bugged code runs in an environment with access control policy with limited (local user) permission.
Operand AttributeDefinition
Data StateData State operand attribute type – Shows where the data comes from.
   EnteredEntered operand attribute – Data are from a user via a user interface (e.g., input field, dialog or a command prompt).
FailureDefinition
ACEArbitrary Code Execution (ACE) – Execution of unauthorized commands or code execution that could lead to everything being lost; remote code execution (RCE) is a sub-case of ACE on a target system or device from a remote location, typically over a network.