CVE-2023-29383: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 3.3
Published: 2023-04-14T22:15Z
Repository: https://github.com/shadow-maint/shadow
Language: C
Files changed: lib/fields.c
Commit date: 2023-03-30 19:23:00 -0500
Commit message: Added control character check

Added control character check, returning -1 (to "err") if control characters are present.

Diff: diff --git a/lib/fields.c b/lib/fields.c
index 640be931f..fb51b5829 100644
--- a/lib/fields.c
+++ b/lib/fields.c
@@ -19,13 +19,13 @@
 /*
  * valid_field - insure that a field contains all legal characters
  *
  * The supplied field is scanned for non-printable and other illegal
  * characters.
- *  + -1 is returned if an illegal character is present.
- *  +  1 is returned if no illegal characters are present, but the field
- *       contains a non-printable character.
+ *  + -1 is returned if an illegal or control character is present.
+ *  +  1 is returned if no illegal or control characters are present,
+ *       but the field contains a non-printable character.
  *  +  0 is returned otherwise.
  */
 int valid_field (const char *field, const char *illegal)
 {
 	const char *cp;
@@ -43,14 +43,17 @@ int valid_field (const char *field, const char *illegal)
 			break;
 		}
 	}
 
 	if (0 == err) {
-		/* Search if there are some non-printable characters */
+		/* Search if there are non-printable or control characters */
 		for (cp = field; '\0' != *cp; cp++) {
 			if (!isprint (*cp)) {
 				err = 1;
+			}
+			if (!iscntrl (*cp)) {
+				err = -1;
 				break;
 			}
 		}
 	}
 

Vulnerable code:  *  + -1 is returned if an illegal character is present.
 *  +  1 is returned if no illegal characters are present, but the field
 *       contains a non-printable character.
		/* Search if there are some non-printable characters */
Fixed code:  *  + -1 is returned if an illegal or control character is present.
 *  +  1 is returned if no illegal or control characters are present,
 *       but the field contains a non-printable character.
		/* Search if there are non-printable or control characters */
			}
			if (!iscntrl (*cp)) {
				err = -1;