by Kastro
Paper/Archive/CVE-2022-24803

CVE-2022-24803

jirutka asciidoctor-include-ext — Command Injection vulnerability in asciidoctor-include-ext

EPSS 3%public exploitCVSS 10.0
critical.is priorityof 100
57
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 85.9.859 × 2017.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.

Affected

ProductAffectedFixed inSource
asciidoctor-include-ext< 0.4.0–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/jirutka/asciidoctor-include-ext/security/advisories/GHSA-v222-6mr4-qj29refgithub.com/jirutka/asciidoctor-include-ext/commit/c7ea001a597c7033575342c51483dab7b87ae155refgithub.com/jirutka/asciidoctor-include-ext/commit/cbaccf3de533cbca224bf61d0b74e4b84d41d8ee