PT-2022-20507 · Github · Octokit

Nickfloyd · Published 2022-06-15 · Updated 2022-06-27 · CVE-2022-31072

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Octokit versions 4.23.0 through 4.24.0

Description The issue concerns the Octokit gem, a Ruby toolkit for the GitHub API, where versions 4.23.0 and 4.24.0 were published with world-writeable files. The gem's files had permissions set to -rw-rw-rw- (i.e., 0666) instead of rw-r--r-- (i.e., 0644), allowing anyone with access to the instance where the release was installed to modify these files. This could potentially enable malicious code already present on a machine to alter the gem's behavior during runtime.

Recommendations For versions 4.23.0 and 4.24.0, consider modifying the file permissions manually to rw-r--r-- (i.e., 0644) until you are able to upgrade to the latest version. Alternatively, for versions 4.23.0 and 4.24.0, use the previous version of the gem, v4.22.0, as a temporary workaround. For a permanent fix, upgrade to Octokit 4.25.0.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-31072

GHSA-G28X-PGR3-QQX6

Affected Products

Octokit

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31072.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/octokit/CVE-2022-31072.yml · Exploit
• https://github.com/octokit/octokit.rb/commit/1c8edecc9cf23d1ceb959d91a416a69f55ce7d55 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31072 · Security Note
• https://ubuntu.com/security/CVE-2022-31072 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-31072 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-31072 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31072 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g28x-pgr3-qqx6 · Vendor Advisory
• https://github.com/octokit/octokit.rb · Note
• https://github.com/octokit/octokit.rb/security/advisories/GHSA-g28x-pgr3-qqx6 · Note
• https://t.me/cibsecurity/44595 · Telegram Post