Experts from the University of Cambridge have published information about a dangerous vulnerability (CVE-2021-42574), which affects almost allmodern source code compilers. The Trojan Source article describes an insidious attack that allows hackers to hide malicious code in the source code of various programs.
The attack is based on how compilers handle unique identifiers used to determine whether text is oriented from left to right or right to left.The weakness lies in the Unicode Bidi algorithm, which allows you to use words written from right to left and left to right together.Thanks to this algorithm, it is possible to combine Arabic and English words.Read text written from right to left, left to right, and vice versa.
In some cases, the algorithm's capabilitiesUnicode Bidi is not enough to change the way these words are displayed, and special control characters are used in such cases. However, if the same line combines words with different text directions, then using these control characters you can change the direction the compiler reads that text and, for example, make lines that look like comments act like executable code.
</ img>
Using this method, you can add maliciousinstruction into the normal source code, and make the text of this instruction invisible when viewing the code using a subsequent comment. This will insert completely different characters, which could actually be arbitrary code. The final source code remains semantically correct, but once compiled, something completely different happens.
When viewing and analyzing such source codethe programmer will see code with comments that do not raise any suspicion, but the compiler or interpreter will reverse the logical order of the symbols, and the innocent comment will turn into additional code inserted into the program. The error is present in almost all compilers – for programming languages C, C++ (gcc and clang), C#, JavaScript (Node.js), Java (OpenJDK 16), Rust, Go and Python; in a variety of popular code editors, including VS Code, Emacs, Atom, and source code viewing interfaces in GitHub, Gitlab, BitBucket, and all Atlassian products.
Source: trojansource, zdnet
</ p>