GHSA-cv5c-2qv5-w2m2 Passbolt Api Remote code execution
Attackers can execute arbitrary bash commands during Passbolt installation by injecting code into PGP key generation fields.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-cv5c-2qv5-w2m2?
GHSA-cv5c-2qv5-w2m2 is a command injection vulnerability in passbolt/passbolt_api, published on 20 May 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user to inject bash code.
The impact is very high, but the probability is very low given that this vulnerability can only be exploited during Passbolt’s installation stage.
Which versions are affected by GHSA-cv5c-2qv5-w2m2?
2 open source packages ship an affected version, including passbolt/passbolt_api.
| Package | Affected | Fixed in |
|---|---|---|
passbolt/passbolt_api Packagist | All versions | 2.7.0 |
passbolt/passbolt_api Packagist | All versions | 2.7.0 |
How do I fix GHSA-cv5c-2qv5-w2m2?
Upgrade passbolt/passbolt_api to 2.7.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-cv5c-2qv5-w2m2 being exploited?
There is no known exploitation of GHSA-cv5c-2qv5-w2m2 in the wild and no public exploit code.