C/C++: Command injection via `wordexp`

[intrigus-lgtm]

Query PR

github/codeql#10077

Language

C/C++

CVE(s) ID list

CVE-2022-3008

CWE

CWE-078

Report

1. What is the vulnerability?
   Passing user-supplied arguments to wordexp will cause command substitution which will cause command injection, leading to code execution.
2. How does the vulnerability work?
   Unsanitised data is passed to a system/shell-like function.
3. What strategy do you use in your query to find the vulnerability?
   TaintTracking + RemoteFlowSource.
4. How have you reduced the number of false positives?
   A call to wordexp is safe, if the WRDE_NOCMD flag is used. This flag disables command substitution.
   This case has been modeled in the query.
   I am currently not aware of other false positives, but will be running this query on lgtm.com and adjust the query accordingly to the results I see.
5. Other information?
   This query was inspired by https://github.com/syoyo/tinygltf/issues/368 which has been found by oss-fuzz using ExecSan.

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

• Yes
• No

Blog post link

No response

[ghsecuritylab]

Your submission is now in status Test run.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Results analysis.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Query review.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Final decision.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[ghsecuritylab]

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed

[xcorail]

Created Hackerone report 1738940 for bounty 431152 : [700] C/C++: Command injection via wordexp

[ghsecuritylab]

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed