High, CVSS 8.7RubyGemsPublished
Remote code execution in dependabot-core branch names when cloning
CVE-2020-26222 · GHSA-23f7-99jx-m54r
- Affected
- RubyGems dependabot-common >= 0.119.0.beta1, < 0.125.1
- Fixed in
- 0.125.1· Vendor fix available
- Issue
- Impact Remote code execution vulnerability in dependabot-common and dependabot-gomodules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. When Dependabot is configured to clone the source repository during an update, Dependabot runs a shell command to git clone the repository: Dependabot will always clone the source repository for gomodules during the file fetching step and can be configured to clone the repository for other package managers using the FileFetcher class from dependabot-common. Patches The fix was applied to version 0.125.1: https://github.com/dependabot/dependabot-core/pull/2727 Workarounds Escape the branch name prior to passing it to the Dependabot::Source class. For example using shellwords:
Recommended action: Upgrade to 0.125.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.