Command Injection Affecting cocoapods-downloader package, versions <1.6.0>=1.6.2, <1.6.3


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.24% (65th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Command Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RUBY-COCOAPODSDOWNLOADER-2414278
  • published1 Apr 2022
  • disclosed2 Mar 2022
  • creditAlessio Della Libera of Snyk Research Team

Introduced: 2 Mar 2022

CVE-2022-24440  (opens in a new tab)
CWE-78  (opens in a new tab)
CWE-88  (opens in a new tab)
First added by Snyk

How to fix?

Upgrade cocoapods-downloader to version 1.6.0, 1.6.3 or higher.

Overview

cocoapods-downloader is an A small library for downloading files from remotes in a folder.

Affected versions of this package are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.

PoC

require 'cocoapods-downloader'

options = { :git => '--upload-pack=touch ./HELLO1;', :branch => 'foo'}
options = Pod::Downloader.preprocess_options(options)

# ls -la

References

CVSS Scores

version 3.1