CVE-2022-31249: Command injection in Git package in Wrangler
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.7988%
CWE
Published
1/25/2023
Updated
6/13/2023
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rancher/wrangler | go | >= 0.8.6, < 0.8.11 | 0.8.11 |
| github.com/rancher/wrangler | go | = 1.0.0 | 1.0.1 |
| github.com/rancher/wrangler | go | < 0.7.4-security1 | 0.7.4-security1 |
| github.com/rancher/wrangler | go | >= 0.8.0, < 0.8.5-security1 | 0.8.5-security1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper argument handling in Git command construction. The commit patches show critical additions of '--' argument separators and quoting fixes in multiple functions. These changes directly address command/argument injection vectors by: 1) Preventing user-controlled values (branch names, revisions) from being interpreted as Git options/flags, and 2) Fixing shell injection in credential helper configuration. The functions modified in the security patches are clearly identified as the vulnerable points where these injection vectors existed.