Log in Start free

Vulnerability · Published Sep 5, 2022 · Assigned by Google

CVE-2022-3008Command Injection on tinygltf

High 8.1

In plain English

A high-severity OS command injection in tinygltf from syoyo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)3.1%top 12.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tinygltf2.5.0+dfsg-5DEBIAN-CVE-2022-3008
Debian:13tinygltf2.5.0+dfsg-5DEBIAN-CVE-2022-3008
Debian:14tinygltf2.5.0+dfsg-5DEBIAN-CVE-2022-3008
Ubuntu:22.04:LTStinygltf2.5.0+dfsg-4ubuntu0.1USN-7129-1
Ubuntu:22.04:LTStinygltf2.5.0+dfsg-4ubuntu0.1UBUNTU-CVE-2022-3008

Affected products (as reported)

VendorProductVersions
syoyo tinygltf unspecified – before 2.6.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

References