CVE-2022-0144: Improper Privilege Management in shelljs/shelljs
A flaw was found in the ShellJS library when the scripts used the exec function. Local users on the filesystem could take advantage of this as they can read the stdout of the ShellJS process. This issue discloses sensitive information, leading to privilege escalation. This flaw allows an attacker to craft stdout files, which leads to crashing the ShellJS scripts running with privileges.
Other sources
shelljs is vulnerable to improper pPrivilege management.
Reference: https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c
Upstream patch: https://github.com/shelljs/shelljs/commit/d919d22dd6de385edaa9d90313075a77f74b338c
— Red Hat
shelljs is vulnerable to Improper Privilege Management
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0144?
CVE-2022-0144 is considered a critical vulnerability as it allows local users to read sensitive information, potentially leading to privilege escalation.
How do I fix CVE-2022-0144?
To fix CVE-2022-0144, upgrade the ShellJS library to version 0.8.5 or later, or apply the relevant patches if you're using IBM Business Automation Insights.
Which versions are affected by CVE-2022-0144?
CVE-2022-0144 affects ShellJS versions prior to 0.8.5 and IBM Business Automation Insights versions up to 25.0.0 inclusive.
Who is impacted by CVE-2022-0144?
Users and applications utilizing the ShellJS library in their scripts, particularly those executing the exec function, are impacted by CVE-2022-0144.
Is CVE-2022-0144 exploitative?
Yes, CVE-2022-0144 could be exploited by local users on the filesystem to escalate their privileges by accessing sensitive information.