navi through 2.24.0 Command Injection via Cheatsheet Substitution

Executive Summary

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect navi cheatsheet directories for files with suspicious names containing shell metacharacters or commands. Check for files like 'x; touch navi_injection_poc; echo x' in suggestion command directories. Review the replace_variables_from_snippet function in navi's code for improper escaping of variable values.

Useful 0 Not Useful 0

Impact Analysis

If you use navi 2.24.0 or earlier, an attacker could trick you into opening a malicious cheatsheet. This could allow them to run arbitrary commands on your system with your user privileges, potentially leading to data theft, system compromise, or further attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized command execution, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is accessed or modified. Organizations using affected navi versions may face compliance violations due to insufficient input validation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade navi to a patched version above 2.24.0. If upgrading is not possible, avoid using untrusted cheatsheets and disable variable interpolation in cheatsheet files. Monitor for unusual command execution patterns in system logs.

Useful 0 Not Useful 0