ewen-lbh ffcss up to 0.1.x lookupPreprocess injection

Summaryinfo

A vulnerability classified as problematic was found in ewen-lbh ffcss up to 0.1.x. This vulnerability affects the function lookupPreprocess. The manipulation results in injection. This vulnerability is identified as CVE-2023-52081. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ewen-lbh ffcss up to 0.1.x. Affected is the function lookupPreprocess. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on integrity. CVE summarizes:

ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (﹍), which would result in the omitted U+005F (_), for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds.

The weakness was released 12/28/2023 as GHSA-wpmx-564x-h2mh. The advisory is available at github.com. This vulnerability is traded as CVE-2023-52081 since 12/26/2023. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1055 by the MITRE ATT&CK project.

Upgrading to version 0.2.0 eliminates this vulnerability. Applying the patch f9c491874b858a32fcae15045f169fd7d02f90dc is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• ewen-lbh

Name

• ffcss

Version

• 0.1

License

• open-source

Website

• Product: https://github.com/ewen-lbh/ffcss/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion