CVE-2020-15167 Arbitrary code execution via configuration file in Miller
Attackers can execute arbitrary code by placing a malicious configuration file in the working directory of the Miller command-line utility.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-15167?
CVE-2020-15167 is a high-severity code injection vulnerability in johnkerl miller, published on 2 Sep 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1.
Which versions are affected by CVE-2020-15167?
It affects 1 product.
Linux distribution packages (1)
miller openSUSE:Tumbleweed | All versions | 5.10.2-1.3 |
Products include Johnkerl Miller.
How do I fix CVE-2020-15167?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-15167 being exploited?
There is no known exploitation of CVE-2020-15167 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-15167, GHSA-mw2v-4q78-j2cw, UBUNTU-CVE-2020-15167, openSUSE-SU-2024:11048-1.