GHSA-33pr-m977-5w97
Soft Serve vulnerable to arbitrary file writing through SSH API
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/charmbracelet/soft-serve | < 0.10.0 | 0.10.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Attackers can create/override arbitrary files with uncontrolled data.
For a PoC, spin up an instance of soft-serve as explained in the README, and execute the following command:
```sh
ssh -p23231 localhost repo commit icecream -- --output=/tmp/pwned
```
It should have created a file in `/tmp/pwned`.
References
External links from the advisory. They lead to third-party sites.