CVE-2022-45145

What it actually does

The vulnerability permits arbitrary operating system command execution by injecting escape characters into .egg package metadata that are processed unsafely by egg-compile.scm during installation.

Why it matters to the business

Attackers can run malicious commands on developer or build systems when packages are installed, potentially leading to full system compromise, supply-chain poisoning, and loss of intellectual property or credentials.

How an attack unfolds

An attacker crafts a malicious .egg file containing shell metacharacters in fields processed by egg-compile.scm. When a victim runs the package manager to install the package, the untrusted input is passed directly to the operating system shell, resulting in command execution.

How to fix it

Upgrade CHICKEN to version 5.3.1 or later. Avoid installing packages from untrusted sources until the update is applied. Rebuild and reinstall any locally cached eggs after upgrading.

How to confirm the fix worked

Confirm CHICKEN version is 5.3.1 or newer via 'chicken-version'. Test installation of a known-good .egg file and verify no unexpected processes or network activity occur. Review package installation logs for any shell command artifacts.

Typical attack path

1. Attacker publishes or hosts a malicious .egg package containing escape sequences in metadata
2. Victim executes chicken-install or equivalent package installation command against the malicious package
3. egg-compile.scm processes the package without sanitizing input and spawns a shell with attacker-controlled arguments
4. Arbitrary OS commands execute with the privileges of the installing user

How to detect it

Inspect package installation logs and shell history for unexpected commands or unusual .egg file names. Look for child processes spawned by chicken-install or csc during package operations. Correlate timestamps of package installs with anomalous system activity.

What your security team should do

• Immediately upgrade all CHICKEN 5.x installations to 5.3.1 or later
• Restrict package installation to verified internal or official repositories
• Monitor build and developer workstations for unexpected command execution during package installs
• Add CHICKEN package verification steps to CI/CD pipelines