OS Command Injection in Rake - CVE-2020-8130

Vulnerability identifier: #VU25721

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8130

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in "Rake::FileList" when supplying a filename that begins with the pipe character "|". A remote unauthenticated attacker can execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Rake
Amazon Linux AMI
SUSE Linux Enterprise Module for Containers
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Opensuse
Fedora
Gitlab Community Edition
GitLab Enterprise Edition
ruby2.1-rubygem-rake
rubygem-rake

Install updates from vendor's website.

Rake - update to 12.3.3
Gitlab Community Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1
GitLab Enterprise Edition - addressed in versions 12.9.8, 12.10.7, 13.0.1
ruby2.1-rubygem-rake - update to 10.3.2-9.7.1
rubygem-rake - addressed in versions 12.3.3-200.fc30, 12.3.3-200.fc31

• https://hackerone.com/reports/651518
• https://lists.debian.org/debian-lts-announce/2020/02/msg00026.html
• https://snyk.io/vuln/SNYK-RUBY-RAKE-552000

• OS Command Injection in rake program in Ruby
• OpenSUSE update for ruby
• GitLab security update for Ruby
• Amazon Linux AMI update for rubygem24-rake
• Amazon Linux AMI update for rubygem-rake
• SUSE update for rubygem-rake
• Fedora 31 update for rubygem-rake
• Fedora 30 update for rubygem-rake