Visual Reordering Vulnerability in Unicode Specification Affecting Multiple Software Vendors
CVE-2021-42574

8.3HIGH

Key Information:

Vendor

Unicode

Status
Unicode
Vendor
CVE Published:
1 November 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 21%

What is CVE-2021-42574?

A vulnerability in the Unicode Specification, particularly in the Bidirectional Algorithm, allows adversaries to manipulate the visual order of characters. This can lead to confusion when analyzing source code, as the logical order of tokens processed by compilers and interpreters may differ from their visual representation. Attackers can exploit this to hide malicious code within seemingly innocuous characters by crafting source code that appears one way to human reviewers while being processed differently by machines, creating a risk for applications supporting Unicode. Careful implementation and adherence to Unicode's security guidelines are crucial to mitigate this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-42574
Created by simplylu

bidi_char_detector
Created by maweil

solidity_CVE-2021-42574-POC
Created by tin-z

References

http://www.unicode.org/versions/Unicode14.0.0/
https://trojansource.codes
http://www.openwall.com/lists/oss-security/2021/11/01/1
mailing-list

EPSS Score

21% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.