CVE-2022-39243
Description
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
How to fix
- nuprocess_project nuprocess2.0.5 or later
- com.zaxxer:nuprocess2.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuprocess_project nuprocess | 1.2.0 ≤ v < 2.0.5 | 2.0.5 |
| com.zaxxer:nuprocessMaven | 1.2.0 ≤ v < 2.0.5 | 2.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.