Miggo Logo
Miggo Vulnerability Database
→
GHSA-p5wf-cmr4-xrwr

GHSA-p5wf-cmr4-xrwr: Permissive Regular Expression in tacquito

7.6

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-p5wf-cmr4-xrwr
EPSS Score
-
CWE
CWE-1333
Published
10/18/2024
Updated
11/1/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/facebookincubator/tacquitogo< 0.0.0-20241011192817-07b49d1358e60.0.0-20241011192817-07b49d1358e6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The core vulnerability stems from 2 key points:

  1. In command.go's evaluate() function, regex patterns were applied without ^/$ anchors via regexp.MatchString, allowing substring matches
  2. CommandArgs() included line endings that could be abused to bypass intended restrictions

The commit patched both issues by:

  1. Adding automatic anchoring in evaluate()
  2. Introducing CommandArgsNoLE() to strip line endings
  3. Adding regex boundary checks Pre-patch versions lacked these safeguards, making these functions vulnerable to regex-based command injection through partial matches.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** *V* is *or * so*tw*r* vuln*r**ility. N*twork **mins w*o **v* **ploy** t**quito (or v*rsions o* t**quito) in t**ir pro*u*tion *nvironm*nts *n* us* t**quito to p*r*orm *omm*n* *ut*oriz*tion *or n*twork **vi**s s*oul* ** imp**t**. T**qui

Reasoning

T** *or* vuln*r**ility st*ms *rom * k*y points: *. In *omm*n*.*o's *v*lu*t*() *un*tion, r***x p*tt*rns w*r* *ppli** wit*out ^/$ *n**ors vi* r***xp.M*t**Strin*, *llowin* su*strin* m*t***s *. *omm*n**r*s() in*lu*** lin* *n*in*s t**t *oul* ** **us** to