// For flags

CVE-2022-36064

Shescape Inefficient Regular Expression Complexity vulnerability

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells `Bash` and `Dash`, or any not-officially-supported Unix shell; and/or using the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. An attacker can cause polynomial backtracking or quadratic runtime in terms of the input string length due to two Regular Expressions in Shescape that are vulnerable to Regular Expression Denial of Service (ReDoS). This bug has been patched in v1.5.10. For `Dash` only, this bug has been patched since v1.5.9. As a workaround, a maximum length can be enforced on input strings to Shescape to reduce the impact of the vulnerability. It is not recommended to try and detect vulnerable input strings, as the logic for this may end up being vulnerable to ReDoS itself.

Shescape es un paquete de escape de shell para JavaScript. Una vulnerabilidad en la Complejidad de las Expresiones Regulares Ineficiente afecta a usuarios que usan Shescape para escapar de argumentos para los shells Unix "Bash" y "Dash", o cualquier shell Unix no soportado oficialmente; y/o usando las funciones "escape" o "escapeAll" con la opción "interpolation" establecida en "true". Un atacante puede causar un retroceso polinómico o un tiempo de ejecución cuadrático en términos de la longitud de la cadena de entrada debido a dos Expresiones Regulares en Shescape que son vulnerables a una Denegación de Servicio de Expresiones Regulares (ReDoS). Este bug ha sido parcheado en versión v1.5.10. Sólo para "Dash", este bug ha sido parcheado desde la v1.5.9. Como mitigación, puede imponerse una longitud máxima en las cadenas de entrada a Shescape para reducir el impacto de la vulnerabilidad. No es recomendado intentar detectar cadenas de entrada vulnerables, ya que la lógica para ello puede acabar siendo vulnerable al propio ReDoS.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-07-15 CVE Reserved
  • 2022-09-06 CVE Published
  • 2024-04-27 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-1333: Inefficient Regular Expression Complexity
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Shescape Project
Search vendor "Shescape Project"
 Shescape
Search vendor "Shescape Project" for product "Shescape"
 >= 1.5.1 < 1.5.10
Search vendor "Shescape Project" for product "Shescape" and version " >= 1.5.1 < 1.5.10"
node.js
Affected