RCE in Find-Exec Project
CVE-2023-40582
find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This issue has been addressed in version 1.0.3. users are advised to upgrade. Users unable to upgrade should ensure that all input passed to find-exec comes from a trusted source.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.015 (72.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Find-exec_project Find-exec
- Shime Find-exec — versions < 1.0.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-40582?
- CVE-2023-40582 is a critical-severity vulnerability in Find-Exec Project, classified under OS Command Injection. CVSS score: 9.8/10. Published 2023-08-30.
- How severe is CVE-2023-40582?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2023-40582 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.