Description
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NSPC911 | rovr | ≤ 0.10.3 | — |
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HyCwXmsjfe third-party-advisory
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L115-L158 technical-description
- https://github.com/NSPC911/rovr/blob/888a1efecd9eb92a773bb21451244c0edcf1a3f1/src/rovr/functions/path.py#L642-L701 technical-description
- v0.10.3 Release Notes release-notes
- https://pypi.org/project/rovr/0.10.3/ product
- VulnCheck Advisory: rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe third-party-advisory