FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a Fem::ConstraintDisplacement object through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand. The escaping helper neutralizes quotation marks but not backslashes, allowing crafted formula text to terminate the generated Python string and execute arbitrary Python code with the FreeCAD process's privileges when a victim accepts the dialog.
This issue is fixed in version 1.1.2.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
freecad:freecad
References 6
https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-2rq3-gx3h-489q
https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-2rq3-gx3h-489q
https://github.com/FreeCAD/FreeCAD/pull/31267
https://github.com/FreeCAD/FreeCAD/pull/31267
https://github.com/FreeCAD/FreeCAD/pull/31312
https://github.com/FreeCAD/FreeCAD/pull/31312
https://github.com/FreeCAD/FreeCAD/commit/0a208ac11cfe7b61c424ee4bb79117138ec50…
https://github.com/FreeCAD/FreeCAD/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2
https://github.com/FreeCAD/FreeCAD/commit/3f60d202a8246958232e2fbc74ba38a83483b…
https://github.com/FreeCAD/FreeCAD/commit/3f60d202a8246958232e2fbc74ba38a83483b74e
https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2
https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2