GHSA-x5c7-x7m2-rhmf Local directory executable lookup in sops (Windows-only)
Local attackers can execute arbitrary code on Windows by placing malicious executables in the current directory when using sops via cmd.exe.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-x5c7-x7m2-rhmf?
GHSA-x5c7-x7m2-rhmf is a command injection vulnerability in go.mozilla.org/sops, published on 20 May 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Impact
Windows users using the sops direct editor option (sops file.yaml) can have a local executable named either vi, vim, or nano executed if running sops from cmd.exe
This attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using cmd.exe or the Windows C library SearchPath function. This is a result of these Windows tools including . within their PATH by default.
If you are using sops within untrusted directories on Windows via cmd.exe, please upgrade immediately
As well, if you have . within your default $PATH, please upgrade immediately.
More information can be found on the official Go blog: https://blog.golang.org/path-security
Patches
The problem has been resolved in v3.7.1
Now, if Windows users using cmd.exe run into this issue, a warning message will be printed:
vim resolves to executable in current directory (.\vim.exe)
References
For more information
If you have any questions or comments about this advisory:
- Open a discussion in sops
Which versions are affected by GHSA-x5c7-x7m2-rhmf?
4 open source packages ship an affected version, including go.mozilla.org/sops/v3 and go.mozilla.org/sops.
| Package | Affected | Fixed in |
|---|---|---|
go.mozilla.org/sops/v3 Go | All versions | 3.7.1 |
go.mozilla.org/sops/v3 Go | All versions | 3.7.1 |
go.mozilla.org/sops/v3 Go | All versions | 3.7.1 |
go.mozilla.org/sops Go | All versions | None |
How do I fix GHSA-x5c7-x7m2-rhmf?
Upgrade go.mozilla.org/sops/v3 to 3.7.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-x5c7-x7m2-rhmf being exploited?
There is no known exploitation of GHSA-x5c7-x7m2-rhmf in the wild and no public exploit code.
Sources
Also known as GO-2022-0410.