Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zMmdxLXg1NmgtMjk5Y84ABCjP

age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.

Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or plugin.NewRecipient APIs.

On UNIX systems, a directory matching ${TMPDIR:-/tmp}/age-plugin-* needs to exist for the attack to succeed.

The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.

An equivalent issue was fixed by the rage project, see advisory GHSA-4fg7-vxc8-qx5w.

Thanks to ⬡-49016 for reporting this.

Permalink: https://github.com/advisories/GHSA-32gq-x56h-299c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zMmdxLXg1NmgtMjk5Y84ABCjP
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 month ago
Updated: about 1 month ago

Identifiers: GHSA-32gq-x56h-299c
References:

• https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c
• https://github.com/FiloSottile/age/commit/482cf6fc9babd3ab06f6606762aac10447222201
• https://github.com/str4d/rage/security/advisories/GHSA-4fg7-vxc8-qx5w
• https://github.com/advisories/GHSA-32gq-x56h-299c

Repository: https://github.com/FiloSottile/age
Blast Radius: 0.0

Affected Packages