Blackduck C Cpp
Monthly
Command injection in Black Duck blackduck-c-cpp before version 3.0.7 enables any actor with write access to a scanned build directory to execute arbitrary OS commands as the account running the scan. The scanner's package manager component traverses the build directory and incorporates discovered filesystem paths into shell command strings without quoting or escaping, making any file or directory whose name contains shell metacharacters an effective injection vector. No public exploit code or active exploitation is confirmed at time of analysis, but the mechanic is standard shell injection requiring no specialized tooling, making this a meaningful risk in shared CI/CD environments where untrusted parties can write to scanned directories.
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.
Command injection in Black Duck blackduck-c-cpp before version 3.0.7 enables any actor with write access to a scanned build directory to execute arbitrary OS commands as the account running the scan. The scanner's package manager component traverses the build directory and incorporates discovered filesystem paths into shell command strings without quoting or escaping, making any file or directory whose name contains shell metacharacters an effective injection vector. No public exploit code or active exploitation is confirmed at time of analysis, but the mechanic is standard shell injection requiring no specialized tooling, making this a meaningful risk in shared CI/CD environments where untrusted parties can write to scanned directories.
Token exfiltration in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows any actor with code execution inside a scanned project's build to read the Black Duck API token from the process environment inherited by scanning subprocesses. The token - when supplied via BLACKDUCK_API_TOKEN or BD_HUB_TOKEN - is passed in plaintext to child processes spawned during build capture and signature scanning, where it is observable by co-located code. No public exploit has been identified at time of analysis; however, the vendor explicitly warns that upgrading does not remediate prior exposure, making token rotation a mandatory incident-response step for all affected deployments.