CWE-95
AllowedImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
264 vulnerabilities reference this CWE, most recent first.
GHSA-3FGR-XJR6-XQM8
Vulnerability from github – Published: 2022-11-28 22:07 – Updated: 2022-11-28 22:07code injection in Wrapper::buildClientWrapperCode via manipulation of the $client argument. It was possible to force the client to access local files or connect to undesired urls instead of the intended target server's url.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpxmlrpc/phpxmlrpc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-28T22:07:33Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "code injection in `Wrapper::buildClientWrapperCode` via manipulation of the `$client` argument. It was possible to force the client to access local files or connect to undesired urls instead of the intended target server\u0027s url.",
"id": "GHSA-3fgr-xjr6-xqm8",
"modified": "2022-11-28T22:07:33Z",
"published": "2022-11-28T22:07:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gggeek/phpxmlrpc/issues/80"
},
{
"type": "WEB",
"url": "https://github.com/gggeek/phpxmlrpc/commit/cf6e605e09d001ce520bfa8e7b168cfa514e663b"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpxmlrpc/phpxmlrpc/2022-11-28-2.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/gggeek/phpxmlrpc"
},
{
"type": "WEB",
"url": "https://github.com/gggeek/phpxmlrpc/releases/tag/4.9.0"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "code injection in phpxmlrpc/phpxmlrpc"
}
GHSA-3MJR-8V4P-9QF4
Vulnerability from github – Published: 2024-08-28 09:30 – Updated: 2024-08-28 09:30A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code.
{
"affected": [],
"aliases": [
"CVE-2023-26323"
],
"database_specific": {
"cwe_ids": [
"CWE-95"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-28T08:15:06Z",
"severity": "HIGH"
},
"details": "A code execution vulnerability exists in the Xiaomi App market product. The vulnerability is caused by unsafe configuration and can be exploited by attackers to execute arbitrary code.",
"id": "GHSA-3mjr-8v4p-9qf4",
"modified": "2024-08-28T09:30:34Z",
"published": "2024-08-28T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26323"
},
{
"type": "WEB",
"url": "https://trust.mi.com/misrc/bulletins/advisory?cveId=543"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-3WHQ-64Q2-QFJ6
Vulnerability from github – Published: 2024-04-25 19:50 – Updated: 2025-01-21 17:53Summary
Using the create_from_blueprint builtin can result in a double eval vulnerability when raw_args=True and the args argument has side-effects.
A contract search was performed and no vulnerable contracts were found in production. In particular, the raw_args variant of create_from_blueprint was not found to be used in production.
Details
It can be seen that the _build_create_IR function of the create_from_blueprint builtin doesn't cache the mentioned args argument to the stack: https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847
As such, it can be evaluated multiple times (instead of retrieving the value from the stack).
PoC
The vulnerability is demonstrated in the following boa test:
src1 = """
c: uint256
"""
deployer = """
created_address: public(address)
deployed: public(uint256)
@external
def get() -> Bytes[32]:
self.deployed += 1
return b''
@external
def create_(target: address):
self.created_address = create_from_blueprint(target, raw_call(self, method_id("get()"), max_outsize=32), raw_args=True, code_offset=3)
"""
Factory = b.loads_partial(src1)
c = Factory.deploy_as_blueprint()
c2 = b.loads(deployer, b'')
c2.create_(c)
c2.deployed()
The output of c2.deployed() is 2 although create_ was called only once and the value was initialized to 0.
Patches
Patched in https://github.com/vyperlang/vyper/pull/3976.
Impact
No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "vyper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-32647"
],
"database_specific": {
"cwe_ids": [
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T19:50:50Z",
"nvd_published_at": "2024-04-25T18:15:08Z",
"severity": "MODERATE"
},
"details": "### Summary\nUsing the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. \n\nA contract search was performed and no vulnerable contracts were found in production. In particular, the `raw_args` variant of `create_from_blueprint` was not found to be used in production.\n\n### Details\nIt can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn\u0027t cache the mentioned `args` argument to the stack: https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847\n\nAs such, it can be evaluated multiple times (instead of retrieving the value from the stack).\n\n### PoC\nThe vulnerability is demonstrated in the following `boa` test:\n``` vyper\nsrc1 = \"\"\"\nc: uint256\n\"\"\"\ndeployer = \"\"\"\ncreated_address: public(address)\ndeployed: public(uint256)\n\n@external\ndef get() -\u003e Bytes[32]:\n self.deployed += 1\n return b\u0027\u0027\n\n@external\ndef create_(target: address):\n self.created_address = create_from_blueprint(target, raw_call(self, method_id(\"get()\"), max_outsize=32), raw_args=True, code_offset=3)\n\"\"\"\n\nFactory = b.loads_partial(src1)\nc = Factory.deploy_as_blueprint()\n\nc2 = b.loads(deployer, b\u0027\u0027)\nc2.create_(c)\nc2.deployed()\n```\nThe output of `c2.deployed()` is `2` although `create_` was called only once and the value was initialized to `0`.\n\n### Patches\nPatched in https://github.com/vyperlang/vyper/pull/3976.\n\n### Impact\nNo vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is `low`.\n",
"id": "GHSA-3whq-64q2-qfj6",
"modified": "2025-01-21T17:53:51Z",
"published": "2024-04-25T19:50:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-3whq-64q2-qfj6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32647"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-208.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/vyperlang/vyper"
},
{
"type": "WEB",
"url": "https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "vyper performs double eval of raw_args in create_from_blueprint"
}
GHSA-42MV-3H37-WFH9
Vulnerability from github – Published: 2024-08-23 18:33 – Updated: 2024-08-23 18:33The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.
{
"affected": [],
"aliases": [
"CVE-2024-7954"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-95"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T18:15:07Z",
"severity": "CRITICAL"
},
"details": "The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request.",
"id": "GHSA-42mv-3h37-wfh9",
"modified": "2024-08-23T18:33:03Z",
"published": "2024-08-23T18:33:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7954"
},
{
"type": "WEB",
"url": "https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-0-alpha2-SPIP-4-2-13-SPIP-4.html"
},
{
"type": "WEB",
"url": "https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_1_the_feather"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/spip-porte-plume"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4655-WH7V-3VMG
Vulnerability from github – Published: 2023-04-12 20:35 – Updated: 2023-04-12 20:35Impact
Steps to reproduce:
It is possible to trick a user with programming rights into visiting /xwiki/bin/view/XWiki/LoggingAdmin?loggeraction_set=1&logger_name=%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dnew+File%28%22%2Ftmp%2Fexploit.txt%22%29.withWriter+%7B+out+-%3E+out.println%28%22created+from+notification+filter+preferences%21%22%29%3B+%7D%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D&logger_level=TRACE where is the URL of your XWiki installation, e.g., by embedding an image with this URL in a document that is viewed by a user with programming rights.
Expected result:
No file in /tmp/exploit.txt has been created.
Actual result:
The file /tmp/exploit.txt is been created with content "created from notification filter preferences!". This demonstrates a CSRF remote code execution vulnerability that could also be used for privilege escalation or data leaks (if the XWiki installation can reach remote hosts).
Patches
The problem has been patched on XWiki 14.4.7, and 14.10.
Workarounds
The issue can be fixed manually applying this patch.
References
- https://jira.xwiki.org/browse/XWIKI-20291
- https://github.com/xwiki/xwiki-platform/commit/49fdfd633ddfa346c522d2fe71754dc72c9496ca
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-logging-ui"
},
"ranges": [
{
"events": [
{
"introduced": "4.2-milestone-3"
},
{
"fixed": "13.10.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-logging-ui"
},
"ranges": [
{
"events": [
{
"introduced": "14.0-rc-1"
},
{
"fixed": "14.4.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-logging-ui"
},
"ranges": [
{
"events": [
{
"introduced": "14.5"
},
{
"fixed": "14.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-29213"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-74",
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-12T20:35:42Z",
"nvd_published_at": "2023-04-17T22:15:10Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\n\n#### Steps to reproduce:\n\nIt is possible to trick a user with programming rights into visiting \u003cxwiki-host\u003e/xwiki/bin/view/XWiki/LoggingAdmin?loggeraction_set=1\u0026logger_name=%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dnew+File%28%22%2Ftmp%2Fexploit.txt%22%29.withWriter+%7B+out+-%3E+out.println%28%22created+from+notification+filter+preferences%21%22%29%3B+%7D%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D\u0026logger_level=TRACE where \u003cxwiki-host\u003e is the URL of your XWiki installation, e.g., by embedding an image with this URL in a document that is viewed by a user with programming rights.\n\n#### Expected result:\n\nNo file in /tmp/exploit.txt has been created.\n\n#### Actual result:\n\nThe file `/tmp/exploit.txt` is been created with content \"created from notification filter preferences!\". This demonstrates a CSRF remote code execution vulnerability that could also be used for privilege escalation or data leaks (if the XWiki installation can reach remote hosts).\n\n\n### Patches\nThe problem has been patched on XWiki 14.4.7, and 14.10.\n\n### Workarounds\nThe issue can be fixed manually applying this [patch](https://github.com/xwiki/xwiki-platform/commit/49fdfd633ddfa346c522d2fe71754dc72c9496ca).\n\n### References\n- https://jira.xwiki.org/browse/XWIKI-20291\n- https://github.com/xwiki/xwiki-platform/commit/49fdfd633ddfa346c522d2fe71754dc72c9496ca\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
"id": "GHSA-4655-wh7v-3vmg",
"modified": "2023-04-12T20:35:42Z",
"published": "2023-04-12T20:35:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4655-wh7v-3vmg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29213"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/49fdfd633ddfa346c522d2fe71754dc72c9496ca"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-platform"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-20291"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "org.xwiki.platform:xwiki-platform-logging-ui Eval Injection vulnerability"
}
GHSA-4CGM-43X9-F8F3
Vulnerability from github – Published: 2025-11-27 15:31 – Updated: 2025-11-27 15:31The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353
{
"affected": [],
"aliases": [
"CVE-2025-12140"
],
"database_specific": {
"cwe_ids": [
"CWE-95"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-27T14:15:50Z",
"severity": "CRITICAL"
},
"details": "The application contains an insecure \u0027redirectToUrl\u0027 mechanism that incorrectly processes the value of the \u0027redirectUrlParameter\u0027 parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution.\nThis issue was fixed in version\u00a0wu#2016.1.5513#0#20251014_113353",
"id": "GHSA-4cgm-43x9-f8f3",
"modified": "2025-11-27T15:31:25Z",
"published": "2025-11-27T15:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12140"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2025/11/CVE-2025-12140"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4FGP-7VVM-M4JF
Vulnerability from github – Published: 2024-09-12 15:33 – Updated: 2024-09-20 19:16An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "refuel-autolabel"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.8"
},
{
"last_affected": "0.0.16"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-27321"
],
"database_specific": {
"cwe_ids": [
"CWE-1236",
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-12T19:49:50Z",
"nvd_published_at": "2024-09-12T13:15:12Z",
"severity": "HIGH"
},
"details": "An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.",
"id": "GHSA-4fgp-7vvm-m4jf",
"modified": "2024-09-20T19:16:57Z",
"published": "2024-09-12T15:33:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27321"
},
{
"type": "PACKAGE",
"url": "https://github.com/refuel-ai/autolabel"
},
{
"type": "WEB",
"url": "https://github.com/refuel-ai/autolabel/blob/v0.0.16/src/autolabel/dataset/validation.py#L129-L146"
},
{
"type": "WEB",
"url": "https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Refuel Autolab Eval Injection vulnerability"
}
GHSA-5GQP-C836-45CR
Vulnerability from github – Published: 2026-04-08 18:34 – Updated: 2026-04-08 18:34An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.
{
"affected": [],
"aliases": [
"CVE-2026-4837"
],
"database_specific": {
"cwe_ids": [
"CWE-95"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T17:21:24Z",
"severity": "MODERATE"
},
"details": "An eval() injection vulnerability in the Rapid7 Insight Agent beaconing logic for Linux versions could theoretically allow an attacker to achieve remote code execution as root via a crafted beacon response. Because the Agent uses mutual TLS (mTLS) to verify commands from the Rapid7 Platform, it is unlikely that the eval() function could be exploited remotely without prior, highly privileged access to the backend platform.",
"id": "GHSA-5gqp-c836-45cr",
"modified": "2026-04-08T18:34:07Z",
"published": "2026-04-08T18:34:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4837"
},
{
"type": "WEB",
"url": "https://docs.rapid7.com/insight/release-notes-2026-april/#improvements-and-fixes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5J7G-CF6R-G2H7
Vulnerability from github – Published: 2022-11-21 22:36 – Updated: 2022-11-21 22:36Impact
Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro.
The URL <server>/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%252F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7BiconPicker%20id%3D%22'%3C%2Fscript%3E%7B%7B%2Fhtml%7D%7D%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dprintln(%2FHellofromIconPickerId%2F)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D%22%20class%3D%22'%3C%2Fscript%3E%7B%7B%2Fhtml%7D%7D%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dprintln(%2FHellofromIconPickerClass%2F)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D%22%2F%7D%7D demonstrates the issue (replace <server> by the URL to your XWiki installation). If the output HellofromIconPickerId or HellofromIconPickerClass is visible, the XWiki installation is vulnerable (normally, all output should be contained in a script-tag and thus invisible).
Patches
The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2.
Workarounds
The patch can be manually applied by editing IconThemesCode.IconPickerMacro in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.
References
- https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01
- https://jira.xwiki.org/browse/XWIKI-19805
For more information
If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-icon-ui"
},
"ranges": [
{
"events": [
{
"introduced": "6.4-milestone-2"
},
{
"fixed": "13.10.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-icon-ui"
},
"ranges": [
{
"events": [
{
"introduced": "14.0.0"
},
{
"fixed": "14.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-41931"
],
"database_specific": {
"cwe_ids": [
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-21T22:36:34Z",
"nvd_published_at": "2022-11-23T20:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\nAny user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro.\n\nThe URL `\u003cserver\u003e/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter\u0026language=en\u0026sourceSyntax=xwiki%252F2.1\u0026stripHTMLEnvelope=true\u0026fromHTML=false\u0026toHTML=true\u0026text=%7B%7BiconPicker%20id%3D%22\u0027%3C%2Fscript%3E%7B%7B%2Fhtml%7D%7D%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dprintln(%2FHellofromIconPickerId%2F)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D%22%20class%3D%22\u0027%3C%2Fscript%3E%7B%7B%2Fhtml%7D%7D%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dprintln(%2FHellofromIconPickerClass%2F)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D%22%2F%7D%7D` demonstrates the issue (replace `\u003cserver\u003e` by the URL to your XWiki installation). If the output `HellofromIconPickerId` or `HellofromIconPickerClass` is visible, the XWiki installation is vulnerable (normally, all output should be contained in a script-tag and thus invisible).\n\n### Patches\n\nThe problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2.\n\n### Workarounds\n\nThe [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.\n\n### References\n* https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01\n* https://jira.xwiki.org/browse/XWIKI-19805\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n",
"id": "GHSA-5j7g-cf6r-g2h7",
"modified": "2022-11-21T22:36:34Z",
"published": "2022-11-21T22:36:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-5j7g-cf6r-g2h7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41931"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-platform"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-19805"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027) in xwiki-platform-icon-ui"
}
GHSA-5JRJ-52X8-M64H
Vulnerability from github – Published: 2024-04-25 19:50 – Updated: 2025-01-21 17:53Summary
Using the sqrt builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).
A contract search was performed and no vulnerable contracts were found in production.
Details
It can be seen that the build_IR function of the sqrt builtin doesn't cache the argument to the stack:
https://github.com/vyperlang/vyper/blob/4595938734d9988f8e46e8df38049ae0559abedb/vyper/builtins/functions.py#L2151
As such, it can be evaluated multiple times (instead of retrieving the value from the stack).
PoC
With at least Vyper version 0.2.15+commit.6e7dba7 the following contract:
c: uint256
@internal
def some_decimal() -> decimal:
self.c += 1
return 1.0
@external
def foo() -> uint256:
k: decimal = sqrt(self.some_decimal())
return self.c
passes the following test:
// SPDX-License-Identifier: MIT
pragma solidity >=0.8.13;
import "../../lib/ds-test/test.sol";
import "../../lib/utils/Console.sol";
import "../../lib/utils/VyperDeployer.sol";
import "../ITest.sol";
contract ConTest is DSTest {
VyperDeployer vyperDeployer = new VyperDeployer();
ITest t;
function setUp() public {
t = ITest(vyperDeployer.deployContract("Test"));
}
function testFoo() public {
uint256 val = t.foo();
console.log(val);
assert (val == 4);
}
}
Patches
Patched in https://github.com/vyperlang/vyper/pull/3976.
Impact
No vulnerable production contracts were found.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "vyper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-32649"
],
"database_specific": {
"cwe_ids": [
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T19:50:16Z",
"nvd_published_at": "2024-04-25T18:15:09Z",
"severity": "MODERATE"
},
"details": "### Summary\nUsing the `sqrt` builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).\n\nA contract search was performed and no vulnerable contracts were found in production.\n\n### Details\nIt can be seen that the `build_IR` function of the `sqrt` builtin doesn\u0027t cache the argument to the stack: \nhttps://github.com/vyperlang/vyper/blob/4595938734d9988f8e46e8df38049ae0559abedb/vyper/builtins/functions.py#L2151\n\nAs such, it can be evaluated multiple times (instead of retrieving the value from the stack).\n\n### PoC\nWith at least Vyper version `0.2.15+commit.6e7dba7` the following contract:\n```vyper\nc: uint256\n\n@internal\ndef some_decimal() -\u003e decimal:\n self.c += 1\n return 1.0\n\n@external\ndef foo() -\u003e uint256:\n k: decimal = sqrt(self.some_decimal())\n return self.c\n```\npasses the following test:\n```solidity\n// SPDX-License-Identifier: MIT\npragma solidity \u003e=0.8.13;\n\nimport \"../../lib/ds-test/test.sol\";\nimport \"../../lib/utils/Console.sol\";\nimport \"../../lib/utils/VyperDeployer.sol\";\n\nimport \"../ITest.sol\";\n\ncontract ConTest is DSTest {\n VyperDeployer vyperDeployer = new VyperDeployer();\n\n ITest t;\n\n function setUp() public {\n t = ITest(vyperDeployer.deployContract(\"Test\"));\n }\n\n function testFoo() public {\n uint256 val = t.foo();\n console.log(val);\n assert (val == 4);\n }\n}\n```\n \n### Patches\nPatched in https://github.com/vyperlang/vyper/pull/3976.\n\n### Impact\nNo vulnerable production contracts were found.",
"id": "GHSA-5jrj-52x8-m64h",
"modified": "2025-01-21T17:53:44Z",
"published": "2024-04-25T19:50:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-5jrj-52x8-m64h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32649"
},
{
"type": "WEB",
"url": "https://github.com/vyperlang/vyper/pull/2914"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-209.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/vyperlang/vyper"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "vyper performs multiple eval of `sqrt()` argument built in"
}
Mitigation
Strategy: Refactoring
If possible, refactor your code so that it does not need to use eval() at all.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation
- Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180, CWE-181). Make sure that your application does not inadvertently decode the same input twice (CWE-174). Such errors could be used to bypass allowlist schemes by introducing dangerous inputs after they have been checked. Use libraries such as the OWASP ESAPI Canonicalization control.
- Consider performing repeated canonicalization until your input does not change any more. This will avoid double-decoding and similar scenarios, but it might inadvertently modify inputs that are allowed to contain properly-encoded dangerous content.
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.