Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NuProcess vulnerable to command-line injection through insertion of NUL character(s)
Vulnerability Description
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check. This vulnerability can only be exploited to inject command line arguments on Linux. Version 2.0.5 contains a patch. As a workaround, users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Vulnerability Title
NuProcess 安全漏洞
Vulnerability Description
NuProcess是Brett Wooldridge个人开发者的一种低开销、非阻塞 I/O、Java 的外部进程实现。 NuProcess 存在安全漏洞，该漏洞源于攻击者可以在其字符串中使用NUL字符来执行命令行注入。以下版本受到影响：使用JVM的Java_java_lang_UNIXProcess_forkAndExec方法（1.2.0+）分叉进程的所有NuProcess版本。
CVSS Information
N/A
Vulnerability Type
N/A