PT-2023-27765 · Unknown · Hyper-Bump-It
Plannigan
·
Published
2023-09-04
·
Updated
2023-09-08
·
CVE-2023-41057
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
hyper-bump-it versions prior to 0.5.1
Description
The issue arises from
hyper-bump-it reading a file glob pattern from the configuration file and combining it with the project root directory to construct a full glob pattern. This pattern is used to find files that should be edited, but it does not check if the matched files are contained within the project root directory. As a result, changes could be written to files outside of the project. The default behavior of hyper-bump-it is to display planned changes and prompt the user for confirmation before editing any files. However, the configuration file provides a field that can be used to cause files to be edited without displaying the prompt.Recommendations
For versions prior to 0.5.1, upgrade to version 0.5.1 or later to resolve the issue.
As a temporary workaround, execute
hyper-bump-it with the --interactive command line argument to ensure that all planned changes are displayed and the user is prompted for confirmation before editing any files, even if the configuration file contains show confirm prompt=true.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hyper-Bump-It