CVE-2023-42658 : Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command

Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.

Published 2023-10-31 15:15:09

Updated 2023-11-08 17:38:07

View at NVD, CVE.org

Products affected by CVE-2023-42658

Chef » Inspec
Versions from including (>=) 5.0.0 and before (<) 5.22.29
cpe:2.3:a:chef:inspec:*:*:*:*:*:*:*:*
Matching versions
Chef » Inspec
Versions before (<) 4.56.58
cpe:2.3:a:chef:inspec:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 34 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	2.0	6.0	Progress Software Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Assigned by:
- nvd@nist.gov (Primary)
- security@progress.com (Secondary)
CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Assigned by: security@progress.com (Secondary)

https://docs.chef.io/inspec/cli/

InSpec CLI
Vendor Advisory
https://community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Inspec-CVE-2023-42658

Product Alert Bulletin – October 2023-CHEF-Inspec-(CVE-2023-42658) - Progress Community
Vendor Advisory
https://docs.chef.io/release_notes_inspec/

Chef InSpec Release Notes
Release Notes;Vendor Advisory

Jump to