vendor:
perl2exe
by:
decrazyo
8.1
CVSS
CRITICAL
Arbitrary Code Execution
94
CWE
Product Name: perl2exe
Affected Version From: <= V30.10C
Affected Version To: Unknown
Patch Exists: NO
Related CWE:
CPE: a:indigostar:perl2exe:30.10
Platforms Tested: Ubuntu 22.04
2023
Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution
perl2exe allows packing Perl scripts into native executables that use the 0th argument to unpack and execute a file. An attacker can leverage this to make the executable run another compiled executable by controlling the 0th argument, enabling them to escape restricted shell environments.
Mitigation:
To mitigate this vulnerability, ensure that executables created with perl2exe are not used to execute untrusted or malicious scripts. Regularly update perl2exe to the latest version to patch known security issues.
