Vulnerability · Published Jun 8, 2023 · Assigned by GitHub_M

CVE-2023-34112JavaCPP project actions vulnerable to code injection

Medium 4.3

In plain English

A medium-severity code injection in javacpp-presets from bytedeco. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)1.9%top 19.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.

Affected products (as reported)

Vendor	Product	Versions
bytedeco	javacpp-presets	< 1.5.9

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/bytedeco/javacpp-presets/security/advisories/GHSA-36rx-hq22-jm5x x_refsource_CONFIRM
https://securitylab.github.com/research/github-actions-untrusted-input/ x_refsource_MISC