Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gitlab.com/uniget-org/cli | go | < 0.27.6 | 0.27.6 |
Miggo AIRoot Cause AnalysisThe analysis of the security advisory and the associated commit 7b4f18a9f00f0955f830c7ccf266ed0de5f9fd91 reveals a path traversal vulnerability in the uniget command-line tool. The root cause is the improper handling of user-supplied filenames for hooks, which are not validated before being used to construct file paths. This allows an attacker to use ../ sequences to escape the intended hooks directory.
The primary vulnerable function is the anonymous RunE function within the editHooksCmd command definition in cmd/uniget/hooks.go. This function takes a filename from the command-line arguments and directly concatenates it with the hooks directory path. This combined path is then passed to an external editor, allowing an attacker to read or write arbitrary files on the system with the privileges of the user running uniget.
A similar vulnerability exists in the RunE function for the removeHooksCmd command, which could be exploited to delete arbitrary files.
Additionally, the processHooks function was found to be vulnerable to symlink attacks. It would follow symbolic links found in the hooks directory, allowing a callback function to be executed on a linked file outside of the intended directory. The patch mitigates these issues by adding explicit path validation to ensure the resolved path is within the hooks directory and by adding checks to disallow the use of symbolic links for hooks.
main.editHooksCmd.RunEcmd/uniget/hooks.go
main.removeHooksCmd.RunEcmd/uniget/hooks.go
main.processHookscmd/uniget/hooks.go