CVE-2020-26222

Dependabot-Core 0.119.0.beta1 to 0.125.1: Remote code execution via source branch name

• CVSS 8.8
• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
• Input Validation and Sanitization
• Remote

Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: "/$({curl,127.0.0.1})", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.

CVE

CVE-2020-26222

CWE

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSS base score

8.8

Published

2020-11-13

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Dependabot-Core to version 0.125.1 or higher.

import os

def clone_repository(branch_name):
    """Vulnerable function that demonstrates the security issue."""
    command = f"git clone -b {branch_name} https://example.com/repo.git"
    os.system(command)

branch_name = "/$({curl,127.0.0.1})"
clone_repository(branch_name)

import subprocess

def contains_blacklisted_characters(branch_name):
    """Secure function that fixes the vulnerability."""
    blacklist = [';', '&', '|', '$', '`', '>', '<', '(', ')', '{', '}', '[', ']', '\\']
    return any(char in branch_name for char in blacklist)

def clone_repository(branch_name):
    """Secure function that fixes the vulnerability."""
    if contains_blacklisted_characters(branch_name):
        raise ValueError("Invalid or potentially dangerous branch name detected.")

    command = ["git", "clone", "-b", branch_name, "https://example.com/repo.git"]
    print(f"Executing command: {' '.join(command)}")
    subprocess.run(command, check=True)

branch_name = "main"
clone_repository(branch_name)

@misc{vaitp:cve202026222,
  title        = {{Dependabot-Core 0.119.0.beta1 to 0.125.1: Remote code execution via source branch name}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-26222},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-26222/}}
}