Description
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ShowDoc | ShowDoc | 2.8.14 – < 3.9.6 | 3.9.6 |
References
- Patch Commit patch
- https://gist.github.com/LioTree/028af150fd991cf9924dd2c7d5912e54 technical-description
- https://github.com/star7th/showdoc/blob/v3.9.5/mock/index.js#L42 technical-description
- https://github.com/star7th/showdoc product
- VulnCheck Advisory: ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates third-party-advisory