GHSA-j73w-8hfr-4gc9: High severity nuget/AlastairLundy.CliInvoke vulnerability
Impact An argument-injection vulnerability exists in the CliInvoke package's runner factory: RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line.
The factory joins the runner arguments, the caller's target, and the caller's arguments into a single ProcessStartInfo.Arguments string and hands it to the OS. The OS command-line parser re-tokenizes the string before the runner sees it. A double quote (") in the target or in any argument closes the OS-level quoted region and lets the next character enter argv as a separate element.
Patches Upgrade to:
- 2.8.5 (2.8.x line) - 2.9.4 (2.9.x line) - 2.10.5 (2.10.x line) - 3.0.0-beta.2 (3.x pre-release line)
Workarounds No complete workaround is available. Until you can upgrade:
- Strip " from any target or argument before passing it to the factory. On shell runners, also strip ;, |, &, $, backtick, and parentheses. - Or bypass the factory entirely and build the ProcessConfiguration directly. Set ArgumentList explicitly to the argv you want the runner to receive.
These are partial mitigations. They shift the quoting problem to your code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/AlastairLundy.CliInvoketo a version that resolves this vulnerability.Fixed in 2.0.2 - Upgrade
Upgrade
nuget/CliInvoketo a version that resolves this vulnerability.Fixed in 3.0.0-beta.2 - Upgrade
Upgrade
nuget/CliInvoketo a version that resolves this vulnerability.Fixed in 2.10.5 - Upgrade
Upgrade
nuget/CliInvoketo a version that resolves this vulnerability.Fixed in 2.9.4 - Upgrade
Upgrade
nuget/CliInvoketo a version that resolves this vulnerability.Fixed in 2.8.5 - Upgrade
Upgrade
RunnerProcessFactoryto a version that resolves this vulnerability.Fixed in 2.10.5 - Upgrade
Upgrade
RunnerProcessFactoryto a version that resolves this vulnerability.Fixed in 2.8.5 - Upgrade
Upgrade
RunnerProcessFactoryto a version that resolves this vulnerability.Fixed in 2.9.4 - Upgrade
Upgrade
RunnerConfigurationFactoryto a version that resolves this vulnerability.Fixed in 3.0.0-beta.2 - Configuration
Set ArgumentList explicitly to the argv the runner should receive instead of passing a combined command-line string.
ProcessStartInfo ArgumentList = Explicit argv elements - Compensating control
Bypass the factory entirely and build the ProcessConfiguration directly.
- Compensating control
Strip double quotes (") from every target and argument before passing them to the factory; on shell runners, also strip semicolons (;), pipes (|), ampersands (&), dollar signs ($), backticks, and parentheses.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using CliInvoke's runner factory are exposed: RunnerProcessFactory in the 2.x line or RunnerConfigurationFactory in the 3.x line. Exposure occurs when caller-controlled or otherwise untrusted data can reach the target or argument values passed to the factory.
What does an attacker need to exploit it?
An attacker needs a way to place a double quote character in the runner target or in any argument passed through the affected factory. The quote can terminate OS-level quoting and cause subsequent characters to be parsed as separate argv elements before the runner receives them.
Are there any mitigations if upgrading is not immediately possible?
There is no complete workaround. As partial mitigation, strip double quotes from targets and arguments; for shell runners, also strip semicolons, pipes, ampersands, dollar signs, backticks, and parentheses. Alternatively, bypass the factory and construct ProcessConfiguration directly with ArgumentList set to the intended argv.
Which versions contain fixes?
Upgrade 2.8.x deployments to 2.8.5, 2.9.x deployments to 2.9.4, 2.10.x deployments to 2.10.5, or 3.x pre-release deployments to 3.0.0-beta.2.