Unratedcrates.ioPublished
rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
GHSA-4fg7-vxc8-qx5w
- Affected
- crates.io rage >= 0.6.0, <= 0.6.0; >= 0.7.0, < 0.7.2; >= 0.8.0, < 0.8.2; >= 0.9.0, < 0.9.3; >= 0.10.0, <= 0.10.0; >= 0.11.0, <= 0.11.0
- Fixed in
- 0.11.10.8.20.9.30.6.10.10.10.7.2· Vendor fix available
- Issue
- A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the rage CLI through an attacker-controlled recipient or identity string, or to the following age APIs when the plugin feature flag is enabled: - age::plugin::Identity::fromstr (or equivalently str::parse::<age::plugin::Identity()) - age::plugin::Identity::defaultforplugin - age::plugin::IdentityPluginV1::new - age::plugin::Recipient::fromstr (or equivalently str::parse::<age::plugin::Recipient()) - age::plugin::RecipientPluginV1::new On UNIX systems, a directory matching age-plugin- needs to exist in the working directory for the attack to succeed. The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol. An…
Recommended action: Upgrade to 0.11.1, 0.10.1, 0.9.3 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.