Ericcornelissen

On Unix systems where the shell is explicitly configured to "sh" or true and `/bin/sh` points to BusyBox, the software fails to properly escape tilde (~) characters in assignment contexts. An attacker providing untrusted input to the `escape()` and `escapeAll()` APIs in an assignment prefixed to a command can inject a tilde payload. This can lead to the disclosure of the user's home directory location or alter the directory where a command operates.

Shescape is a JavaScript shell escape library. A flaw exists where an attacker may be able to bypass escaping for the shell being used, potentially leading to exposure of sensitive information. This issue impacts users who configure the `shell` option to point to a file on disk that is a symbolic link to another symbolic link. The outcome of a successful exploit depends on the specific shell in use and how Shescape identifies it. The provided proof of concept demonstrates the bypass using a crafted payload with the `userInput` variable and the `shescape.escape()` function. The example uses the `/api/v1/exec` endpoint to execute commands.

Insufficient validation of parameters in `Deno.makeTemp*` APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect other systems. A user may provide a prefix or suffix to a `Deno.makeTemp*` API containing path traversal characters.

The issue affects users of Shescape on Windows in a threaded context, allowing attackers to bypass protections by exploiting Shescape's failure to correctly escape for the expected shell. This can occur when the expected default system shell is different from the one actually used, such as when configuring the use of PowerShell but Shescape defaults to escaping for CMD instead.

An attacker may be able to get read-only access to environment variables. This issue affects users of Shescape on Windows using the Windows Command Prompt, and when using `quote`/`quoteAll` or `escape`/`escapeAll` with the `interpolation` option set to `true`. For example, an attacker can exploit this by using a payload like `%PATH%` in the `shescape.quote()` or `shescape.escape()` functions, allowing them to access the contents of the PATH environment variable.

An Inefficient Regular Expression Complexity issue affects Shescape users who utilize it to escape arguments for Unix shells, including Bash and Dash, particularly when using the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. This allows an attacker to cause polynomial backtracking or quadratic runtime in terms of the input string length due to vulnerable Regular Expressions. A workaround involves enforcing a maximum length on input strings to reduce the vulnerability's impact.

The issue impacts users of the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. If an attacker can include whitespace in their input, they can invoke shell-specific behavior or arbitrary commands through various means, including shell-specific special characters, line feed, or carriage return characters. This affects multiple shells, including Bash, Dash, Zsh, and PowerShell.

The issue impacts users of Shescape who use any API function to escape arguments for cmd.exe on Windows. An attacker can omit all arguments following their input by including a line feed character (` `) in the payload. This allows for code injection on Windows.

The issue allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the shescape API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of shescape is used, directory traversal may be possible in the application using shescape .

The issue affects shescape, a simple shell escape package for JavaScript, where users may still be vulnerable to shell injection if an attacker manages to insert a null character into the payload. This can be exploited, for example, by inserting a null character in a payload on Windows. The problem has been patched in version 1.1.3.