PT-2020-5156 · Ruby+2 · Rake+2

Kyoshida · Published 2020-02-24 · Updated 2022-09-08 · CVE-2020-8130

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rake versions prior to 12.3.3

Description The issue is related to an OS command injection vulnerability in the Rake::FileList class of the Rake build automation tool. This vulnerability arises from the failure to neutralize special elements used in operating system commands. Exploitation of this issue can allow an attacker to execute arbitrary commands. The vulnerability is triggered when a filename starting with the pipe character | is supplied.

Recommendations For versions prior to 12.3.3, update to version 12.3.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of filenames that begin with the pipe character | in the Rake::FileList class until a patch is applied. Restrict access to the Rake::FileList class to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-05763

CVE-2020-8130

DLA-2120-1

GHSA-JPPV-GW3R-W3Q8

MGASA-2020-0121

OPENSUSE-SU-2020:0395-1

OPENSUSE-SU-2020_0395-1

RHSA-2021:4702

SUSE-SU-2020:0737-1

SUSE-SU-2022:3212-1

SUSE-SU-2022_3212-1

USN-4295-1

Affected Products

Rake

Suse

Ubuntu

References · 55

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rake/CVE-2020-8130.yml · Exploit
• 🔥 https://hackerone.com/reports/651518 · Exploit
• https://cve.org/CVERecord?id=CVE-2020-8130 · Security Note
• https://usn.ubuntu.com/4295-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-8130 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jppv-gw3r-w3q8 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2120-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4295-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8130 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VXMX4ARNX2JLRJMSH4N3J3UBMUT5CI44 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0395-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory