Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-30844

CVE-2023-30844: Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints

3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-30844
GHSA ID
GHSA-jmp2-wc4p-wfh2
EPSS Score
0.56753%
CWE
CWE-116
Published
5/5/2023
Updated
11/5/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/mutagen-io/mutagengo< 0.16.60.16.6
github.com/mutagen-io/mutagen-composego< 0.17.10.17.1
github.com/mutagen-io/mutagengo>= 0.17.0, < 0.17.10.17.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability explicitly affects the templating functionality of 'list' and 'monitor' commands. While the JSON template function was already safe, the advisory states that raw template output remained unescaped. The addition of a new 'shellSanitize' template function in patches indicates that the default raw output path lacked proper sanitization. Though exact function names aren't provided in available data, the core issue resides in the template rendering logic for these commands when handling untrusted input from remote endpoints.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Mut***n *omm*n* lin* op*r*tions, *s w*ll *s t** lo* output *rom `mut***n ***mon run`, *r* sus**pti*l* to *ontrol ***r**t*rs t**t *oul* ** provi*** *y r*mot* *n*points. T*is **n **us* t*rmin*l *orruption, *it**r int*ntion*l or unint*ntion

Reasoning

T** vuln*r**ility *xpli*itly *****ts t** t*mpl*tin* *un*tion*lity o* 'list' *n* 'monitor' *omm*n*s. W*il* t** JSON t*mpl*t* `*un*tion` w*s *lr***y s***, t** **visory st*t*s t**t r*w t*mpl*t* output r*m*in** un*s**p**. T** ***ition o* * n*w 's**llS*ni