PT-2022-14934 · Unknown · Cocoapods-Downloader

Alessio Della Libera · Published 2022-04-01 · Updated 2022-04-08 · CVE-2022-21223

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cocoapods-downloader versions prior to 1.6.2

Description The issue allows for Command Injection via hg argument injection. When the download function is called using hg, the url and/or revision, tag, branch are passed to the hg clone command in a way that allows additional flags to be set, which can be used to perform a command injection.

Recommendations For versions prior to 1.6.2, update to version 1.6.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the hg argument in the download function to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Argument Injection

Weakness Enumeration

CWE-74

CWE-88

Related Identifiers

CVE-2022-21223

GHSA-G397-V4W5-4M79

SNYK-RUBY-COCOAPODSDOWNLOADER-2414280

Affected Products

Cocoapods-Downloader

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cocoapods-downloader/CVE-2022-21223.yml · Exploit
• https://github.com/CocoaPods/cocoapods-downloader/pull/127 · Patch
• https://osv.dev/vulnerability/CVE-2022-21223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21223 · Security Note
• https://osv.dev/vulnerability/GHSA-g397-v4w5-4m79 · Vendor Advisory
• https://github.com/CocoaPods/cocoapods-downloader · Note
• https://t.me/cibsecurity/40014 · Telegram Post
• https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414280 · Note