GHSA-5vwr-qchf-q4pf: @cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
SummaryA command injection vulnerability existed in the Maven scanning flow of cdxgen before version 12.4.3.When cdxgen scanned an attacker-controlled Maven project, repository-controlled paths could be used in the Maven command construction. In affected versions, some Maven invocations were executed with `shell: true`. A directory name containing shell metacharacters could therefore be interpreted by the shell instead of being treated only as a filesystem path.This could allow an attacker who controls a scanned repository to execute commands in the cdxgen process context.The issue affected both the CLI and server mode. The issue is patched in `12.4.3`.Affected assetProject: cdxgenTested version: 12.4.1Mode tested: server modeEndpoint: `POST /sbom`Scanner path: Java / Maven project scanningPatchVersion 12.4.3 includes hardening for this issue with PR #4059The patch adds multiple mitigations:Maven command invocations no longer use unconditional shell execution on POSIX platforms.Bazel command invocation was similarly changed away from unconditional shell execution.Windows compatibility is preserved using `shell: isWin` where needed.`safeSpawnSync` now blocks `shell: true` invocations when the command or direct argument values contain shell metacharacters.cdxgen does not validate or sanitise every nested directory. The threat model is updated to clarify mitigation scope.WorkaroundsThe recommended remediation is to upgrade to 12.4.3 or later.If immediate upgrade is not possible:Do not run cdxgen server mode on untrusted networks.Do not expose POST /sbom to unauthenticated or untrusted clients.Avoid scanning untrusted Java/Maven repositories.Run cdxgen inside a locked-down container or sandbox.Remove sensitive environment variables from the cdxgen process environment.Use least-privilege filesystem mounts.Restrict outbound network access where possible.Use cdxgen secure/dry-run modes where suitable to inspect planned operations before performing scans.
Configure host and command allowlists where applicable, such as:CDXGEN_SERVER_ALLOWED_HOSTSCDXGEN_GIT_ALLOWED_HOSTSCDXGEN_ALLOWED_COMMANDSCDXGEN_SECURE_MODE=trueThese mitigations reduce exposure but do not fully address the vulnerable command construction in affected versions.Threat model clarificationThe mitigation added in 12.4.3 applies to the cdxgen process boundary. Specifically, cdxgen now hardens command, option, and path values that cdxgen itself passes to external processes through safeSpawnSync.This does not mean cdxgen sanitizes every nested path, module name, generated path, or project-controlled value that an external build tool later discovers and interprets inside its own process. Once cdxgen safely invokes Maven, Gradle, Bazel, SBT, or another build tool, that tool’s internal behavior remains a separate trust boundary.In scope for this fix:command and argument values passed directly by cdxgen to child processes;cdxgen’s own use of shell: true;Maven/Bazel command invocation paths controlled by cdxgen.Out of scope for this specific mitigation:arbitrary nested paths later discovered by Maven itself;Maven plugin behavior;Maven lifecycle hooks;build-tool-specific interpretation of project files after cdxgen has launched the tool.This residual risk is documented in the cdxgen threat model and is why untrusted project scans should still be run in sandboxed, least-privileged environments.DetectionPossible indicators of exploitation or probing include:Maven module directories containing shell metacharacters such as:Logs showing settings.xml or pom.xml discovered in suspicious paths.Unexpected files created outside the scanned repository during a Java/Maven scan.Unexpected child process behavior during cdxgen server scans.cdxgen server receiving POST /sbom requests for attacker-controlled Git URLs.Example suspicious path pattern:CreditsReported-By: @aleff-githubResourcesPatch PR - https://github.com/cdxgen/cdxgen/pull/4059
CVSS v4.0: 6.9