PT-2022-20506 · Unknown · Octopoller

Nickfloyd · Published 2022-06-15 · Updated 2022-06-27 · CVE-2022-31071

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions octopoller version 0.2.0

Description The issue arises from the octopoller gem being packed with files having their permissions set to -rw-rw-rw- (i.e. 0666) instead of rw-r--r-- (i.e. 0644) in version 0.2.0. This means that everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. Malicious code already present and running on the machine could modify the gem’s files and change its behavior during runtime.

Recommendations For version 0.2.0, consider modifying the file permissions manually until you are able to upgrade to the latest version, which is 0.3.0. Alternatively, downgrade to version 0.1.0 until the latest version is available. As a temporary workaround, manually set the file permissions to rw-r--r-- (i.e. 0644) to prevent unauthorized modifications.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-31071

GHSA-26QJ-CR27-R5C4

Affected Products

Octopoller

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31071.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/octopoller/CVE-2022-31071.yml · Exploit
• https://github.com/octokit/octopoller.rb/commit/abed2b8d05abe2cc3eb6bdfb34e53d465e7c7874 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31071 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31071 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26qj-cr27-r5c4 · Vendor Advisory
• https://github.com/octokit/octopoller.rb/security/advisories/GHSA-26qj-cr27-r5c4 · Note
• ❌ https://github.com/octokit/octopoller · Note, Deleted