Aperi'Solve Unauthenticated RCE via Password Field
Aperi'Solve is an open-source steganography analysis platform. Prior to v3.2.1, the optional password field on JPEG uploads was passed into a bash command without sanitization, giving unauthenticated root RCE in the worker container.
HRConvert2 Unauthenticated RCE via Incomplete Character Blacklist on Filenames
HRConvert2 is an open-source file conversion tool. Prior to v3.4, the character blacklist on filenames was missing the backtick character (
`), tab character (
\t), and newline character (
\n). User input from filenames was passed into command line tools for file conversion, allowing both immediate command execution and upload of PHP webshells.
Unreal Engine Blueprint Command Execution via Unrestricted URL Scheme in LaunchURL
Unreal Engine is a game engine developed by Epic Games. Through version 5.8.0, the
LaunchURL Blueprint node ships with an empty URL scheme filter, allowing all schemes by default. On Windows, a
file:/// scheme calls
ShellExecuteW with the
open verb on the path provided, causing the referenced file to be executed. Thus, games that load user-generated Blueprint content are susceptible to command execution via a malicious local file or a remote file on a WebDAV share.