RUSTSEC-2024-0433

See a problem?
Please try reporting it to the source first.
Source
https://rustsec.org/advisories/RUSTSEC-2024-0433
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2024-0433.json
JSON Data
https://api.osv.dev/v1/vulns/RUSTSEC-2024-0433
Aliases
Related
Published
2024-12-18T12:00:00Z
Modified
2025-01-03T18:42:21.256300Z
Summary
Malicious plugin names, recipients, or identities can cause arbitrary binary execution
Details

A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.

Such a plugin name can be provided through an attacker-controlled input to the following age APIs when the plugin feature flag is enabled: - age::plugin::Identity::from_str (or equivalently str::parse::<age::plugin::Identity>()) - age::plugin::Identity::default_for_plugin - age::plugin::IdentityPluginV1::new (the plugin_name argument) - age::plugin::Recipient::from_str (or equivalently str::parse::<age::plugin::Recipient>()) - age::plugin::RecipientPluginV1::new (the plugin_name argument)

On UNIX systems, a directory matching age-plugin-* needs to exist in the working directory for the attack to succeed.

The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.

An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.

Thanks to ⬡-49016 for reporting this issue.

Database specific 
{
    "license": "CC0-1.0"
}
References

Affected packages

crates.io / age

Package

Name
age
View open source insights on deps.dev
Purl
pkg:cargo/age

Affected ranges

Type
SEMVER
Events
Introduced
0.6.0
Fixed
0.6.1
Introduced
0.7.0
Fixed
0.7.2
Introduced
0.8.0
Fixed
0.8.2
Introduced
0.9.0
Fixed
0.9.3
Introduced
0.10.0
Fixed
0.10.1
Introduced
0.11.0
Fixed
0.11.1

Ecosystem specific 

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [
            "age::plugin::Identity::default_for_plugin",
            "age::plugin::Identity::from_str",
            "age::plugin::IdentityPluginV1::new",
            "age::plugin::Recipient::from_str",
            "age::plugin::RecipientPluginV1::new"
        ],
        "arch": []
    }
}

Database specific 

{
    "cvss": null,
    "informational": null,
    "categories": [
        "code-execution"
    ]
}