CVE-2021-41037 Code injection in Eclipse Equinox p2
Attackers can inject malicious code into Eclipse installations via unsigned metadata in p2 touchpoints, leading to arbitrary code execution during installation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41037?
CVE-2021-41037 is a critical code injection vulnerability in The Eclipse Foundation Eclipse Equinox p2, published on 8 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source.
Weakness: CWE-829
Which versions are affected by CVE-2021-41037?
It affects 1 product.
Products include Eclipse Equinox P2.
How do I fix CVE-2021-41037?
No fix has been published for CVE-2021-41037 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-41037 being exploited?
There is no known exploitation of CVE-2021-41037 in the wild and no public exploit code.
Sources
Also known as GHSA-99r4-wvv3-fpr3.