CVE-2014-0177: Hub Package Arbitrary File Overwrite
Summary
CVE-2014-0177: Hub Package Arbitrary File Overwrite. Affects github.com/github/hub versions < 1.12.1. Fixed in 1.12.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hub package is a command-line tool that provides a consistent interface to interact with GitHub repositories. It is written in Go and Ruby and is widely used by developers for managing their GitHub workflows. This vulnerability, identified as CVE-2014-0177, allows local users to overwrite arbitrary files by exploiting a symlink attack on a temporary patch file.
Vulnerability Detail
The vulnerability arises from the am function in the lib/hub/commands.rb file. This function does not properly handle temporary patch files, making it susceptible to symlink attacks. By creating a malicious symlink, an attacker can trick the am function into overwriting arbitrary files on the system. This could lead to unauthorized modifications, data loss, or even remote code execution if the overwritten file is executed by another process.
How To Fix
Minimum fixed version
1.12.1
This is the first release that contains the fix.
go get github.com/github/hub@v1.12.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, users can mitigate the risk by avoiding the use of the am function or by manually verifying the integrity of patch files before applying them. Additionally, users should ensure that they have appropriate file system permissions in place to prevent unauthorized file overwrites.
Conclusion
The vulnerability in the hub package allows local users to overwrite arbitrary files on the system through a symlink attack. To mitigate this risk, it is recommended to update to version 1.12.1 or later. If immediate updating is not possible, users should exercise caution when using the affected function and ensure proper file system permissions. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/github/hub →
FAQ
This vulnerability allows local users to overwrite arbitrary files on the system, which can lead to unauthorized modifications, data loss, or potential remote code execution.
No, this vulnerability requires local access to the system in order to create the malicious symlinks and overwrite files.
There are no known instances of this vulnerability being exploited in the wild at this time.
Yes, the CVSS score for this vulnerability is 4.4, indicating a moderate severity.
Yes, you can find more details about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-x5m6-jh4r-34mv/GHSA-x5m6-jh4r-34mv.json
