title: InSpec Archive Command Vulnerable to Maliciously Crafted Profile
description:
Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
collectionURL: https://community.chef.io/downloads/tools/inspec?os=windows
defaultStatus: affected
modules: [InSpec Archive, InSpec Check, InSpec Export]
packageName: InSpec
platforms: [Windows, Linux, MacOS]
product: Chef InSpec
repo: https://github.com/inspec/inspec
vendor: Progress Software Corporation
versions:
lessThan: 4.56.58 , status: affected, version: 4.0.0, versionType: semver
lessThan: 5.22.29, status: affected, version: 5.0.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Solution (optional): Customers should adopt the latest releases of InSpec on the 4, 5, and 6 supported versions available from the community and customer downloads portals.
workarounds:
Workaround (optional): Chef recommends all users to manually inspect and lint with a tool similar to test-kitchen all profiles and cookbooks prior to usage in production.