Several recently identified vulnerabilities:
- A critical vulnerability (CVE-2022-41034) has been discovered in the Visual Studio Code (VS Code) editor, allowing the execution of code when a user opens a link prepared by an attacker. The code can be executed on the computer with VS Code as well as on any other computers connected to VS Code via the 'Remote Development' feature. The issue poses the greatest risk to users of the web version of VS Code and web editors based on it, including GitHub Codespaces and github.dev.
The vulnerability is caused by the ability to process the 'command:' protocol links to open a terminal window and execute arbitrary shell commands when processing specially formatted Jupyter Notebook documents uploaded from web server, controlled by the attacker (external files with the '.ipynb' extension open without additional confirmations in 'isTrusted' mode, allowing the processing of 'command:').
- A vulnerability (CVE-2022-45939) has been found in the text editor GNU Emacs, allowing command execution upon opening a file with code by substituting special characters in the name, processed using the ctags toolkit.
- An open-source data visualization platform Grafana has a vulnerability (CVE-2022-31097) that allows the execution of JavaScript code when displaying notifications through the Grafana Alerting system. An attacker with editor (Editor) rights can prepare a specially crafted link and gain access to the Grafana interface with administrator rights if the administrator clicks on this link. The vulnerability has been fixed in Grafana versions 9.2.7, 9.3.0, 9.0.3, 8.5.9, 8.4.10, and 8.3.10.
- A vulnerability (CVE-2022-46146) in the exporter-toolkit library used to create metric export modules for Prometheus. This issue allows bypassing basic authentication.
- A vulnerability (CVE-2022-44635) in the Apache Fineract financial services platform allows an unauthenticated user to achieve remote code execution. The problem is caused by lack of proper sanitization of the '..' characters in paths processed by the file upload component. The vulnerability has been addressed in Apache Fineract releases 1.7.1 and 1.8.1.
- A vulnerability (CVE-2022-46366) in the Java framework Apache Tapestry allows remote code execution through the deserialization of specially crafted data. The issue only affects the old branch Apache Tapestry 3.x, which is no longer supported.
- Vulnerabilities in Apache Airflow providers for Hive (CVE-2022-41131), Pinot (CVE-2022-38649), Pig (CVE-2022-40189), and Spark (CVE-2022-40954) lead to remote code execution via arbitrary file uploads or command injection in the context of task execution, without write access to DAG files.
Source: opennet.ru
