UnratedGoPublished
Local directory executable lookup in sops (Windows-only)
GHSA-x5c7-x7m2-rhmf
- Affected
- Go go.mozilla.org/sops/v3 < 3.7.1
- Fixed in
- 3.7.1· Vendor fix available
- Issue
- Impact Windows users using the sops direct editor option (sops file.yaml) can have a local executable named either vi, vim, or nano executed if running sops from cmd.exe This attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using cmd.exe or the Windows C library SearchPath function. This is a result of these Windows tools including . within their PATH by default. If you are using sops within untrusted directories on Windows via cmd.exe, please upgrade immediately As well, if you have . within your default $PATH, please upgrade immediately. More information can be found on the official Go blog: https://blog.golang.org/path-security Patches The problem has been resolved in v3.7.1 Now, if Windows users using cmd.exe run into this issue, a warning message will be printed: vim resolves to executable in current directory (.\vim.exe) References…
Recommended action: Upgrade to 3.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.