GHSA-pp74-39w2-v4w9 CVE-2021-31154 RUSTSEC-2021-0102
Permissions bypass in pleaser
- Severity
- 7.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.47%
- Chance of exploitation in the next 30 days. Higher than 40.54% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-340 Generation of Predictable Numbers or Identifiers
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- Fix
0.4.0- Upgrade pleaser to this version or later
Description
pleaseedit in pleaser before 0.4.0 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.
Affected versions
crates.io
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pleaser crates.io → 0.4.0
- cargo
cargo update -p pleaser --precise 0.4.0
Severity breakdown
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-340: Generation of Predictable Numbers or Identifiers
The product uses a scheme that generates numbers or identifiers that are more predictable than required.
CWE-59: Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-cgf8-h3fp-h956 Pleaser privilege escalation vulnerability | High | Also affects pleaser |
| GHSA-f3fg-5j9p-vchc File exposure in pleaser | Low | Also affects pleaser |
| GHSA-vc5p-j8vw-mc6x Permissions bypass in pleaser | High | Also affects pleaser |
| GHSA-4277-m35q-7c9w Salt preflight script could be attacker controlled | Medium | Same weakness, CWE-340 |
| GHSA-mh98-763h-m9v4 JUJU_CONTEXT_ID is a predictable authentication secret | High | Same weakness, CWE-340 |
| GHSA-mpmx-gm5v-q789 Puppet uses predictable filenames, allowing arbitrary file overwrite | Medium | Same weakness, CWE-340 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor