GHSA-4fg7-vxc8-qx5w: rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
N/A
CVSS Score
Basic Information
CVE ID
-
GHSA ID
EPSS Score
-
CWE
Published
12/18/2024
Updated
1/3/2025
KEV Status
No
Technology
Rust
RustTechnical Details
CVSS Vector
-
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rage | rust | = 0.6.0 | 0.6.1 |
| age | rust | = 0.6.0 | 0.6.1 |
| age | rust | >= 0.7.0, < 0.7.2 | 0.7.2 |
| age | rust | >= 0.8.0, < 0.8.2 | 0.8.2 |
| age | rust | >= 0.9.0, < 0.9.3 | 0.9.3 |
| age | rust | = 0.10.0 | 0.10.1 |
| age | rust | = 0.11.0 | 0.11.1 |
| rage | rust | >= 0.7.0, < 0.7.2 | 0.7.2 |
| rage | rust | >= 0.8.0, < 0.8.2 | 0.8.2 |
| rage | rust | >= 0.9.0, < 0.9.3 | 0.9.3 |
| rage | rust | = 0.10.0 | 0.10.1 |
| rage | rust | = 0.11.0 | 0.11.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from insufficient validation of plugin names in multiple API entry points. The commit diff shows added validation logic in age/src/plugin.rs for these specific functions, confirming they previously lacked proper sanitization. Advisory documents explicitly list these functions as attack vectors when processing attacker-controlled inputs. The functions construct plugin binaries using untrusted names without restricting special characters, enabling path traversal attacks on UNIX systems when combined with age-plugin-* directories.