rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
Package
Affected versions
= 0.6.0
>= 0.7.0, < 0.7.2
>= 0.8.0, < 0.8.2
>= 0.9.0, < 0.9.3
= 0.10.0
= 0.11.0
Patched versions
0.6.1
0.7.2
0.8.2
0.9.3
0.10.1
0.11.1
= 0.6.0
>= 0.7.0, < 0.7.2
>= 0.8.0, < 0.8.2
>= 0.9.0, < 0.9.3
= 0.10.0
= 0.11.0
0.6.1
0.7.2
0.8.2
0.9.3
0.10.1
0.11.1
Description
Published to the GitHub Advisory Database
Dec 18, 2024
Reviewed
Dec 18, 2024
Last updated
Dec 18, 2024
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided to the
rageCLI through an attacker-controlled recipient or identity string, or to the followingageAPIs when thepluginfeature flag is enabled:age::plugin::Identity::from_str(or equivalentlystr::parse::<age::plugin::Identity>())age::plugin::Identity::default_for_pluginage::plugin::IdentityPluginV1::newage::plugin::Recipient::from_str(or equivalentlystr::parse::<age::plugin::Recipient>())age::plugin::RecipientPluginV1::newOn UNIX systems, a directory matching
age-plugin-*needs to exist in the working directory for the attack to succeed.The binary is executed with a single flag, either
--age-plugin=recipient-v1or--age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.
Thanks to ⬡-49016 for reporting this issue.
References