GHSA-33pr-m977-5w97HighCVSS 7.7
Soft Serve vulnerable to arbitrary file writing through SSH API
🔗 CVE IDs covered (1)
📋 Description
Attackers can create/override arbitrary files with uncontrolled data.
For a PoC, spin up an instance of soft-serve as explained in the README, and execute the following command:
ssh -p23231 localhost repo commit icecream -- --output=/tmp/pwned
It should have created a file in /tmp/pwned.
🎯 Affected products1
- go/github.com/charmbracelet/soft-serve:< 0.10.0