What is the CVSS score of CVE-2022-24725?

CVE-2022-24725 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2022-24725?

Yes, a public proof-of-concept exploit is available for CVE-2022-24725. Prioritise patching immediately. EPSS: 0.5%.

Is there a patch available for CVE-2022-24725?

Yes, a patch is available for CVE-2022-24725. Update the affected software to the latest version immediately.

Shescape CVE-2022-24725

MEDIUM

Information Exposure (CWE-200)

2022-03-03 security-advisories@github.com

Information Disclosure Path Traversal Shescape Shescape Project

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Mar 03, 2022 - 22:15 nvd

MEDIUM 5.5

DescriptionNVD

Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the escape or escapeAll functions from the _shescape_ API with the interpolation option set to true. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_. The issue was patched in version 1.5.1. As a workaround, manually escape all instances of the tilde character (~) using arg.replace(/~/g, "\\~").

AnalysisAI

Shescape is a shell escape package for JavaScript. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the escape or escapeAll functions from the _shescape_ API with the interpolation option set to true. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_. The issue was patched in version 1.5.1. As a workaround, manually escape all instances of the tilde character (~) using arg.replace(/~/g, "\\~"). Affected products include: Shescape Project Shescape. Version information: version 1.5.1..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.