GHSA-66m2-493m-crh2

Source

https://github.com/advisories/GHSA-66m2-493m-crh2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-66m2-493m-crh2/GHSA-66m2-493m-crh2.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-66m2-493m-crh2

Aliases

Published

2023-09-25T18:37:51Z

Modified

2024-10-09T23:00:53.637703Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Searchor CLI's Search vulnerable to Arbitrary Code using Eval

Details

An issue in Arjun Sharda's Searchor before version v.2.4.2 allows an attacker to execute arbitrary code via a crafted script to the eval() function in Searchor's src/searchor/main.py file, affecting the search feature in Searchor's CLI (Command Line Interface).

Impact

Versions equal to, or below 2.4.1 are affected.

Patches

Versions above, or equal to 2.4.2 have patched the vulnerability.

References

https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit- https://github.com/jonnyzar/POC-Searchor-2.4.2 https://github.com/ArjunSharda/Searchor/pull/130

Database specific

{
    "nvd_published_at": "2023-12-12T18:15:22Z",
    "cwe_ids": [
        "CWE-74",
        "CWE-94"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-25T18:37:51Z"
}

References

Affected packages

PyPI / searchor

Package

Name: searchor; View open source insights on deps.dev
Purl: pkg:pypi/searchor

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.2

Affected versions

1.*

1.0.3

1.0.4

1.0.5

1.1.0

1.1.1

1.2.0

1.3.0

1.4.0

2.*

2.0.0

2.0.1

2.0.2

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0

2.3.1

2.3.2

2.4.0

2.4.1

Database specific

{
    "last_known_affected_version_range": "<= 2.4.1"
}