CVE-2022-25648
Published: 19 April 2022
Summary
CVE-2022-25648 is a high-severity Argument Injection (CWE-88) vulnerability in Fedoraproject Fedora. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a command injection issue, tracked as CWE-88, that affects the ruby-git package in versions before 1.11.0. It occurs because the fetch(remote = 'origin', opts = {}) function passes the remote parameter directly to the underlying git fetch subcommand without sufficient sanitization, allowing arbitrary flags to be supplied.
An unauthenticated remote attacker can supply a malicious remote value to trigger the injection. Successful exploitation can lead to execution of arbitrary commands on the host running the affected code, resulting in full compromise of confidentiality, integrity, and availability under the reported CVSS 8.1 conditions.
The project addressed the flaw in release 1.11.0 via pull request 569. Distribution advisories for Debian and Fedora likewise direct users to update to the patched ruby-git version to eliminate the argument-injection vector. The associated EPSS score has remained flat at a modest level since disclosure and shows no material increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1646
Vulnerability details
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags…
more
can be set. The additional flags can be used to perform a command injection.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.