Command Injection in Shell-quote - CVE-2021-42740

Vulnerability identifier: #VU67516

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-42740

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to improper input validation in the regex designed to support Windows drive letters before passing it into the exec() call. A remote attacker can pass specially crafted payload to the application and execute arbitrary code on the system.

Shell-quote
Cloud Pak for Security (CP4S)
SUSE Manager Retail Branch Server
SUSE Manager Server Module
SUSE Manager Server
SUSE Manager Proxy Module
SUSE Manager Proxy
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Proxy
IBM Edge Application Manager
image-sync-formula
saltboot-formula
inter-server-sync
inter-server-sync-debuginfo
prometheus-formula
grafana-formula
salt-netapi-client
subscription-matcher
virtual-host-gatherer-Nutanix
virtual-host-gatherer-VMware
virtual-host-gatherer-libcloud
virtual-host-gatherer
virtual-host-gatherer-Kubernetes
smdba
cobbler
httpcomponents-asyncclient
susemanager-tftpsync-recv
supportutils-plugin-susemanager
python3-uyuni-common-libs
python3-rhnlib
spacewalk-search
mgr-osad
python3-mgr-osa-common
python3-mgr-osad
python3-mgr-osa-dispatcher
mgr-osa-dispatcher
release-notes-susemanager-proxy
release-notes-susemanager
mgr-daemon
spacewalk-proxy-installer
spacewalk-admin
spacewalk-proxy-common
spacewalk-proxy-broker
spacewalk-proxy-management
spacewalk-proxy-package-manager
spacewalk-proxy-redirect
spacewalk-proxy-salt
python3-spacewalk-certs-tools
spacewalk-certs-tools
spacecmd
python3-spacewalk-client-tools
spacewalk-client-tools
spacewalk-check
python3-spacewalk-client-setup
python3-spacewalk-check
spacewalk-client-setup
susemanager-schema
spacewalk-backend-tools
spacewalk-backend-package-push-server
spacewalk-backend-iss-export
spacewalk-backend-server
spacewalk-backend-sql
spacewalk-backend-iss
spacewalk-backend-config-files-tool
spacewalk-backend-config-files-common
spacewalk-backend-sql-postgresql
spacewalk-backend-xml-export-libs
spacewalk-backend-xmlrpc
spacewalk-backend-config-files
spacewalk-backend-applet
spacewalk-backend-app
spacewalk-backend
uyuni-config-modules
susemanager-sls
spacewalk-base-minimal
spacewalk-base-minimal-config
spacewalk-html
spacewalk-base
susemanager-tools
susemanager
spacewalk-java-postgresql
spacewalk-java-lib
spacewalk-taskomatic
spacewalk-java-config
spacewalk-java
patterns-suma_retail
patterns-suma_server
patterns-suma_proxy
susemanager-docs_en
susemanager-docs_en-pdf
susemanager-doc-indexes
woodstox
drools
susemanager-build-keys-web
susemanager-build-keys
py27-compat-salt
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Cloud Pak for Multicloud Management Infrastructure Management
MobileFirst Platform
QRadar User Behavior Analytics

Install updates from vendor's website.

Shell-quote - update to 1.7.3
Cloud Pak for Security (CP4S) - update to 1.10.7.0
image-sync-formula - update to 0.1.1661440526.b08d95b-150300.3.3.2
saltboot-formula - addressed in versions 0.1.1661440526.b08d95b-150300.3.12.2, 0.1.1676908681.e90e0b1-150300.3.15.1
inter-server-sync - addressed in versions 0.2.3-150300.8.22.2, 0.2.7-150300.8.28.2
inter-server-sync-debuginfo - addressed in versions 0.2.3-150300.8.22.2, 0.2.7-150300.8.28.2
prometheus-formula - update to 0.7.0-150300.3.17.2
grafana-formula - update to 0.8.1-150300.3.9.2
salt-netapi-client - addressed in versions 0.20.0-150300.3.9.4, 0.21.0-150300.3.12.4
subscription-matcher - update to 0.29-150300.6.12.2
virtual-host-gatherer-Nutanix - update to 1.0.24-150300.3.9.2
virtual-host-gatherer-VMware - update to 1.0.24-150300.3.9.2
virtual-host-gatherer-libcloud - update to 1.0.24-150300.3.9.2
virtual-host-gatherer - update to 1.0.24-150300.3.9.2
virtual-host-gatherer-Kubernetes - update to 1.0.24-150300.3.9.2
smdba - update to 1.7.11-0.150300.3.12.2
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 1.8.0
Cloud Pak for Multicloud Management Infrastructure Management - update to 2.3 Fix Pack 5
cobbler - update to 3.1.2-150300.5.19.1
httpcomponents-asyncclient - update to 4.1.4-150300.3.3.2
QRadar User Behavior Analytics - update to 4.1.11
susemanager-tftpsync-recv - addressed in versions 4.2.5-150300.3.6.2, 4.3.7-150400.3.3.3
supportutils-plugin-susemanager - update to 4.2.5-150300.3.9.2
python3-uyuni-common-libs - addressed in versions 4.2.7-150300.3.9.2, 4.2.9-150300.3.14.1, 4.3.6-150400.3.6.4
python3-rhnlib - update to 4.2.7-150300.4.12.2
spacewalk-search - addressed in versions 4.2.8-150300.3.12.2, 4.2.9-150300.3.15.2
mgr-osad - update to 4.2.9-150300.2.12.2
python3-mgr-osa-common - update to 4.2.9-150300.2.12.2
python3-mgr-osad - update to 4.2.9-150300.2.12.2
python3-mgr-osa-dispatcher - update to 4.2.9-150300.2.12.2
mgr-osa-dispatcher - update to 4.2.9-150300.2.12.2
release-notes-susemanager-proxy - addressed in versions 4.2.9-150300.3.43.1, 4.3.2-150400.3.9.3
release-notes-susemanager - addressed in versions 4.2.9-150300.3.54.1, 4.3.2-150400.3.15.1
mgr-daemon - addressed in versions 4.2.10-150300.2.9.4, 4.3.6-150400.3.6.4
spacewalk-proxy-installer - update to 4.2.11-150300.3.14.2
spacewalk-admin - addressed in versions 4.2.12-150300.3.15.3, 4.2.13-150300.3.18.1
spacewalk-proxy-common - addressed in versions 4.2.12-150300.3.21.3, 4.2.13-150300.3.24.2
spacewalk-proxy-broker - addressed in versions 4.2.12-150300.3.21.3, 4.2.13-150300.3.24.2
spacewalk-proxy-management - addressed in versions 4.2.12-150300.3.21.3, 4.2.13-150300.3.24.2
spacewalk-proxy-package-manager - addressed in versions 4.2.12-150300.3.21.3, 4.2.13-150300.3.24.2
spacewalk-proxy-redirect - addressed in versions 4.2.12-150300.3.21.3, 4.2.13-150300.3.24.2
spacewalk-proxy-salt - addressed in versions 4.2.12-150300.3.21.3, 4.2.13-150300.3.24.2
python3-spacewalk-certs-tools - addressed in versions 4.2.18-150300.3.24.3, 4.2.19-150300.3.27.4, 4.3.15-150400.3.6.2
spacewalk-certs-tools - addressed in versions 4.2.18-150300.3.24.3, 4.2.19-150300.3.27.4, 4.3.15-150400.3.6.2
spacecmd - addressed in versions 4.2.19-150300.4.27.2, 4.2.21-150300.4.33.2, 4.3.15-150400.3.6.4
python3-spacewalk-client-tools - addressed in versions 4.2.20-150300.4.24.3, 4.2.22-150300.4.30.2, 4.3.12-150400.3.6.6
spacewalk-client-tools - addressed in versions 4.2.20-150300.4.24.3, 4.2.22-150300.4.30.2, 4.3.12-150400.3.6.6
spacewalk-check - addressed in versions 4.2.20-150300.4.24.3, 4.2.22-150300.4.30.2, 4.3.12-150400.3.6.6
python3-spacewalk-client-setup - addressed in versions 4.2.20-150300.4.24.3, 4.2.22-150300.4.30.2, 4.3.12-150400.3.6.6
python3-spacewalk-check - addressed in versions 4.2.20-150300.4.24.3, 4.2.22-150300.4.30.2, 4.3.12-150400.3.6.6
spacewalk-client-setup - addressed in versions 4.2.20-150300.4.24.3, 4.2.22-150300.4.30.2, 4.3.12-150400.3.6.6
susemanager-schema - addressed in versions 4.2.24-150300.3.27.3, 4.2.27-150300.3.35.1
spacewalk-backend-tools - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-package-push-server - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-iss-export - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-server - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-sql - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-iss - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-config-files-tool - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-config-files-common - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-sql-postgresql - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-xml-export-libs - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-xmlrpc - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-config-files - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-applet - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend-app - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6
spacewalk-backend - addressed in versions 4.2.24-150300.4.29.5, 4.2.26-150300.4.35.6, 4.3.16-150400.3.6.8
uyuni-config-modules - addressed in versions 4.2.27-150300.3.33.4, 4.2.31-150300.3.43.1
susemanager-sls - addressed in versions 4.2.27-150300.3.33.4, 4.2.31-150300.3.43.1
spacewalk-base-minimal - addressed in versions 4.2.29-150300.3.27.3, 4.2.32-150300.3.36.4, 4.3.24-150400.3.6.4
spacewalk-base-minimal-config - addressed in versions 4.2.29-150300.3.27.3, 4.2.32-150300.3.36.4, 4.3.24-150400.3.6.4
spacewalk-html - addressed in versions 4.2.29-150300.3.27.3, 4.2.32-150300.3.36.4
spacewalk-base - addressed in versions 4.2.29-150300.3.27.3, 4.2.32-150300.3.36.4
susemanager-tools - addressed in versions 4.2.37-150300.3.41.1, 4.2.40-150300.3.49.1
susemanager - addressed in versions 4.2.37-150300.3.41.1, 4.2.40-150300.3.49.1
spacewalk-java-postgresql - addressed in versions 4.2.41-150300.3.43.5, 4.2.47-150300.3.58.1
spacewalk-java-lib - addressed in versions 4.2.41-150300.3.43.5, 4.2.47-150300.3.58.1
spacewalk-taskomatic - addressed in versions 4.2.41-150300.3.43.5, 4.2.47-150300.3.58.1
spacewalk-java-config - addressed in versions 4.2.41-150300.3.43.5, 4.2.47-150300.3.58.1
spacewalk-java - addressed in versions 4.2.41-150300.3.43.5, 4.2.47-150300.3.58.1
patterns-suma_retail - update to 4.2-150300.4.12.2
patterns-suma_server - update to 4.2-150300.4.12.2
patterns-suma_proxy - update to 4.2-150300.4.12.2
susemanager-docs_en - addressed in versions 4.2-150300.12.33.2, 4.2-150300.12.39.2
susemanager-docs_en-pdf - addressed in versions 4.2-150300.12.33.2, 4.2-150300.12.39.2
susemanager-doc-indexes - addressed in versions 4.2-150300.12.33.4, 4.2-150300.12.39.4
woodstox - update to 4.4.2-150300.3.6.2
drools - addressed in versions 7.17.0-150300.4.6.2, 7.17.0-150300.4.9.2
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202301121031
susemanager-build-keys-web - addressed in versions 15.3.6-150300.3.6.2, 15.4.3-150400.3.6.1
susemanager-build-keys - addressed in versions 15.3.6-150300.3.6.2, 15.4.3-150400.3.6.1
py27-compat-salt - addressed in versions 3000.3-150300.7.7.23.2, 3000.3-150300.7.7.29.2

• https://github.com/substack/node-shell-quote/commit/5799416ed454aa4ec9afafc895b4e31760ea1abe
• https://www.npmjs.com/package/shell-quote
• https://github.com/substack/node-shell-quote/blob/master/CHANGELOG.md#173

• Remote command injection in shell-quote package for Node.js
• SUSE update for release-notes-susemanager, release-notes-susemanager-proxy
• SUSE update for SUSE Manager Server 4.2
• SUSE update for SUSE Manager Proxy 4.3
• Command injection in IBM Cloud Pak for Multicloud Management Managed Services
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Command Injection in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Data Virtualization on Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• SUSE update for SUSE Manager 4.2.11
• Multiple vulnerabilities in IBM MobileFirst Platform Foundation
• SUSE update for release-notes-susemanager, release-notes-susemanager-proxy