SQ30118
Detected presence of structural file format exploits.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | fail | high | high | 1 | malware: fail Reason: malformed components found |
About the issue
File formats are either textual or binary structured object streams. Programs that work with them, called parsers, depend on understanding the format structure. Intentional deviations from the expected file format structure can cause parsing issues, and trigger unintended code execution. Some of these malformations can be linked to abuses of known format parsing vulnerabilities. Such specially crafted files are detected as malicious exploits, and are typically labeled by the vulnerability they are abusing.
How to resolve the issue
- If the software intent does not relate to file format validation, investigate the build and release environment for software supply chain compromise.
- Proceed with increased caution when using this software package.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- File format (External resource - Wikipedia)
- Format string attack (External resource - OWASP)