CVE-2021-42574 has a selected CVSS score of 8.3 (high); EIP currently links 9 repository PoCs and 3 lab environments.
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
The artifact is a Python tool named 'bidi-guard' that scans source code files for invisible bidirectional Unicode characters associated with CVE-2021-42574 (Trojan Source). It detects and reports the presence of these characters but does not exploit the vulnerability.
No backdoor observed in reviewed code
The reviewed source files (README.md, bidi_guard/scanner.py, pyproject.toml) implement a payload withheld for CVE-2021-42574. No backdoor, deceptive payload, or concealed harmful behavior was observed. The code reads files, scans for specific Unicode code points, and reports findings. It does not execute downloaded content, establish persistence, exfiltrate data, or perform any unrelated harmful actions.
The code's primary operation is to detect and report the presence of dangerous Unicode bidirectional characters in source files. It does not contain any code that exploits the vulnerability (e.g., crafting or injecting malicious bidi sequences to alter program logic). The README explicitly describes it as a scanner ('Scan code for invisible bidirectional Unicode characters') and the scanner.py module implements detection logic.
README.md:5bidi_guard/scanner.py:1bidi_guard/scanner.py:150-200README.md:35pyproject.toml:5README.md:42-45README.md:48README.md:93-112bidi_guard/scanner.py:150-200README.md:55README.md:76README.md:56README.md:5bidi_guard/scanner.py:150-200pyproject.toml:15-17This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
The artifact is a security toolkit that detects and cleans invisible Unicode characters in source code and data files. It provides a CI checker (check-invisibles.py) that scans files for dangerous Unicode ranges and exits with a non-zero code on detection, and a sanitizer (clean-invisibles.py) that removes such characters and generates an audit log. The tools are designed to mitigate CVE-2021-42574 (Trojan Source) and related Unicode attacks. No exploit code is present; the tools only identify and report the presence of dangerous characters.
No backdoor observed in reviewed code
The repository contains a security toolkit for detecting and cleaning invisible Unicode characters in COBOL source code, addressing CVE-2021-42574. The provided Python scripts perform local file scanning and sanitization as documented. No concealed, deceptive, or harmful behavior targeting the operator or unrelated systems was found.
The primary artifact is a scanner. The check-invisibles.py script is explicitly described as a 'CI checker' that 'exits 1 on detection' (README.md line 32). It scans files for dangerous Unicode characters and reports their locations without modifying the target or exercising a vulnerability. The clean-invisibles.py script is a sanitizer that removes dangerous characters, which is a defensive tool, not an exploit. No code in the artifact attempts to exploit CVE-2021-42574 or any other vulnerability; it only detects and cleans the presence of dangerous Unicode sequences.
README.md:32tools/check-invisibles.py:1-14tools/check-invisibles.py:37-43tools/check-invisibles.py:1tools/check-invisibles.py:66-74tools/check-invisibles.py:20-28tools/check-invisibles.py:34tools/check-invisibles.py:54-62tools/check-invisibles.py:85-94tools/clean-invisibles.py:82-86tools/check-invisibles.py:46-63tools/check-invisibles.py:85-91tools/clean-invisibles.py:34-89tools/check-invisibles.py:1-98tools/clean-invisibles.py:1-135This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A containerized GitHub Action that scans source code for Unicode control characters, based on a Red Hat diagnostic tool. The Dockerfile builds an image from a UBI9 Python 3.9 base, copies a Python script, an entrypoint script, and a license, and sets the entrypoint to run the script with user-supplied arguments.
Dockerfile:1-11entrypoint.sh:1-9src/find_unicode_control2.py:1-248The README explicitly states the action detects 'Trojan source attacks (CVE-2021-42574,CVE-2021-42694)' and references a Red Hat vulnerability advisory. The included Python script is designed to find Unicode bidirectional control characters, which are the basis for these CVEs. The environment is a tool for identifying the vulnerability, not a target to be exploited, but it is directly associated with vulnerability research.
README.md:3-5src/find_unicode_control2.py:1-9Defines the image based on registry.access.redhat.com/ubi9/python-39:1, copies local files (LICENSE, src directory, entrypoint.sh) into the image, and sets the entrypoint to /entrypoint.sh with a default argument of '.'.
Dockerfile:1-11A bash script that prints the received arguments and then executes /src/find_unicode_control2.py with all arguments passed to the container.
entrypoint.sh:1-9A Python script that recursively scans files and directories for Unicode control characters, including bidirectional control characters. It can be configured to look for all non-printable characters or only bidirectional ones, and outputs findings with file and line information. It is the core tool for detecting CVE-2021-42574 and CVE-2021-42694.
src/find_unicode_control2.py:1-248A test script that builds the Docker image and runs it with the argument '-d /src'. It expects the script to find Unicode control characters in its own source (causing a non-zero exit), and reports success or failure accordingly.
tests/run-tests.sh:1-16Supported by supplied evidence
The README associates the action with CVE-2021-42574 (Trojan Source attacks). The Python script specifically scans for Unicode bidirectional control characters (e.g., U+202A-U+202E, U+2066-U+2069), which are the mechanism for CVE-2021-42574. The script's purpose aligns with detecting this vulnerability.
README.md:3-5src/find_unicode_control2.py:1-9src/find_unicode_control2.py:218-222Supported by supplied evidence
The README also lists CVE-2021-42694 alongside CVE-2021-42574. CVE-2021-42694 is a related issue involving homoglyph attacks using Unicode characters. The script's ability to scan for all non-printable Unicode characters (with the '-p all' option) covers the broader class of Unicode-based attacks, including homoglyphs. The tool is designed to detect such characters, supporting the association.
README.md:3-5src/find_unicode_control2.py:1-9src/find_unicode_control2.py:210-216tests/run-tests.sh:5Dockerfile:10tests/run-tests.sh:5tests/run-tests.sh:9entrypoint.sh:8src/find_unicode_control2.py:240-248The container runs a Python script that reads and analyzes text files for Unicode control characters. It does not modify files, connect to external networks, or perform any destructive actions. The test script builds and runs the container locally, expecting a non-zero exit from the scanner when it finds characters in its own source. There is no evidence of host escape, persistence, credential theft, or backdoor behavior.
src/find_unicode_control2.py:1-248tests/run-tests.sh:1-16This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A Rust-based tool (bidi_detector) that scans files for Unicode BIDI characters to detect potential Trojan Source attacks (CVE-2021-42574). It is packaged as a minimal Docker container using a multi-stage build (rust:alpine builder, scratch runtime). The tool reads a TOML config file and uses glob patterns to include/exclude files. A test file with embedded BIDI characters is included.
Dockerfile:1-24README.md:1-4src/main.rs:1-176The README explicitly states the tool checks for Unicode BIDI characters to mitigate CVE-2021-42574, references the Trojan Source paper, and includes a test file (example-commenting-out.js) that demonstrates the vulnerability. The code implements detection logic for the specific BIDI characters associated with the attack.
README.md:1-4src/lib.rs:1-141test/example-commenting-out.js:1-6The main application built from src/main.rs and src/lib.rs. It reads a configuration file (bidi_config.toml), uses glob patterns to find files, scans them for specific Unicode BIDI characters (e.g., U+202A, U+202B, U+202D, U+202E, U+2066, U+2067, U+2068, U+202C, U+2069), and reports occurrences. It exits with code 1 if any BIDI characters are found.
src/main.rs:1-176src/lib.rs:1-141Multi-stage Dockerfile that builds the Rust project in a rust:alpine builder stage and copies the statically linked binary into a scratch image. The entrypoint runs the bidi_detector binary. The working directory is /data, where a volume mount is expected for scanning.
Dockerfile:1-24A JavaScript file containing hidden Unicode BIDI characters (RLO, LRI, PDI) that visually alter code logic, demonstrating the Trojan Source attack. Used in unit tests to verify detection.
test/example-commenting-out.js:1-6src/lib.rs:120-141A TOML configuration file that defines include/exclude glob patterns and display settings for the scanner. Not included in the evidence text, but referenced in the code and README.
src/main.rs:7README.md:30Supported by supplied evidence
The tool is explicitly designed to detect Unicode BIDI characters that enable the Trojan Source attack described in CVE-2021-42574. The README links to the CVE, the code checks for the specific characters listed in the vulnerability research, and the test file demonstrates the attack vector.
README.md:1-4src/lib.rs:1-141test/example-commenting-out.js:1-6README.md:18-20Dockerfile:22src/main.rs:7README.md:30Dockerfile:1-24README.md:18-20src/main.rs:1-176src/lib.rs:120-141The tool only reads files from a user-mounted volume, scans for specific Unicode characters, and prints results to stdout/stderr. It does not modify files, connect to external networks, persist data, or execute any code from scanned files. The Dockerfile uses a scratch base image with no shell or additional utilities, and the binary is statically compiled. No hidden or unnecessary behavior is observed.
src/main.rs:1-176Dockerfile:1-24This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A single Dockerfile builds a Rust binary named CVE-2021-42574 from local source and runs it. The README notes compiler version differences, and the source contains Unicode bidirectional control characters in a string comparison, consistent with a CVE-2021-42574 demonstration.
Dockerfile:1-7README.md:1-3src/main.rs:1-9The repository name, binary name, and source code all reference CVE-2021-42574. The source demonstrates a Unicode bidirectional attack via a string comparison, and the README describes compiler version behavior relevant to the vulnerability. This is a minimal reproduction environment for the CVE.
Dockerfile:1-7src/main.rs:1-9README.md:1-3Provides the Rust 1.56 toolchain to compile the source and run the resulting binary.
Dockerfile:1A Rust binary built from src/main.rs that prints 'admin' or 'user' based on a string comparison containing Unicode bidirectional override characters, illustrating CVE-2021-42574.
Dockerfile:5-7src/main.rs:1-9Contains a main function that compares a hardcoded string against a string with Unicode bidirectional characters, demonstrating how source code can appear to have a different logical flow than what is executed.
src/main.rs:1-9Supported by supplied evidence
The source code directly implements a Unicode bidirectional attack (Trojan Source) by using Unicode control characters in a string comparison, which is the core of CVE-2021-42574. The README confirms the vulnerability is present in Rust 1.56 and fixed in 1.56.1.
src/main.rs:3-5README.md:1-3Dockerfile:1-7Dockerfile:1Dockerfile:1-5Dockerfile:7src/main.rs:1-9The Dockerfile only builds and runs a local binary that prints to stdout. There are no network connections, volume mounts, privilege escalations, or host modifications. The behavior is entirely contained within the container and directly serves the vulnerability demonstration.
Dockerfile:1-7src/main.rs:1-9This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.