- Reported
-
- Issued
-
- Package
-
age
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Aliases
-
- References
-
- Related
-
- Patched
-
>=0.6.1, <0.7.0>=0.7.2, <0.8.0>=0.8.2, <0.9.0>=0.9.3, <0.10.0>=0.10.1, <0.11.0>=0.11.1
- Unaffected
-
- Affected Functions
- Version
age::plugin::Identity::default_for_plugin-
>=0.7.0, <0.7.2>=0.8.0, <0.8.2>=0.9.0, <0.9.3^0.10.0^0.11.0
age::plugin::Identity::from_str-
^0.6.0>=0.7.0, <0.7.2>=0.8.0, <0.8.2>=0.9.0, <0.9.3^0.10.0^0.11.0
age::plugin::IdentityPluginV1::new-
^0.6.0>=0.7.0, <0.7.2>=0.8.0, <0.8.2>=0.9.0, <0.9.3^0.10.0^0.11.0
age::plugin::Recipient::from_str-
^0.6.0>=0.7.0, <0.7.2>=0.8.0, <0.8.2>=0.9.0, <0.9.3^0.10.0^0.11.0
age::plugin::RecipientPluginV1::new-
^0.6.0>=0.7.0, <0.7.2>=0.8.0, <0.8.2>=0.9.0, <0.9.3^0.10.0^0.11.0
Description
A plugin name containing a path separator may allow an attacker to execute an arbitrary
binary.
Such a plugin name can be provided through an attacker-controlled input to the following
age APIs when the plugin feature flag is enabled:
On UNIX systems, a directory matching age-plugin-* needs to exist in the working
directory for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or
--age-plugin=identity-v1. The standard input includes the recipient or identity string,
and the random file key (if encrypting) or the header of the file (if decrypting). The
format is constrained by the age-plugin protocol.
An equivalent issue was fixed in the reference Go implementation of age,
see advisory GHSA-32gq-x56h-299c.
Thanks to ⬡-49016 for reporting this issue.
Advisory available under CC0-1.0
license.