CVE-2022-39243
- Source
- https://cve.org/CVERecord?id=CVE-2022-39243
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39243.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-39243
- Aliases
- Downstream
- Published
- 2022-09-26T13:25:11Z
- Modified
- 2025-12-04T10:35:20.008110Z
- Severity
-
- 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- NuProcess vulnerable to command-line injection through insertion of NUL character(s)
- Details
-
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's JavajavalangUNIXProcessforkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
- Database specific
{ "cwe_ids": [ "CWE-77" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39243.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39243.json
- https://github.com/brettwooldridge/NuProcess/commit/29bc09de561bf00ff9bf77123756363a9709f868
- https://github.com/brettwooldridge/NuProcess/pull/143
- https://github.com/brettwooldridge/NuProcess/security/advisories/GHSA-cxgf-v2p8-7ph7
- https://nvd.nist.gov/vuln/detail/CVE-2022-39243