CVE-2021-42561

CALDERA 2.8.1 Human plugin allows shell command injection via unsanitized "name" parameter

• CVSS 8.8
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• Input Validation and Sanitization
• Remote

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters (e.g., backticks "“" or dollar parenthesis "$()" ) in order to escape the current command and execute arbitrary shell commands.

CVE

CVE-2021-42561

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS base score

8.8

Published

2022-01-12

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update CALDERA to version 2.8.2 or higher.

import os

def execute_command(name):
    """Vulnerable function that demonstrates the security issue."""
    command = f"echo {name}"
    os.system(command)

user_input = "user_input; ls"
execute_command(user_input)

import shlex
import subprocess

def execute_command(name):
    """Secure function that fixes the vulnerability."""
    modified_name = shlex.quote(name)
    command = f"echo {modified_name}"
    subprocess.run(command, shell=True, check=True)

user_input = "user_input; ls"
execute_command(user_input)

@misc{vaitp:cve202142561,
  title        = {{CALDERA 2.8.1 Human plugin allows shell command injection via unsanitized "name" parameter}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-42561},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-42561/}}
}