Impact
FishActivator defines no quote(), so it inherits ViaTemplateActivator.quote, which returns shlex.quote(string). That function follows POSIX sh rules, where a backslash inside single quotes stays a literal character. fish reads \' inside single quotes as an escaped quote and \\ as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than where shlex.quote put the end, and fish expands the command substitution that follows.
The environment path reaches set -gx VIRTUAL_ENV, and --prompt or VIRTUALENV_PROMPT reaches set -gx VIRTUAL_ENV_PROMPT. For --prompt "x\'\$(touch PWNED)'\'", the generated activate.fish contains:
set -gx VIRTUAL_ENV_PROMPT 'x\'"'"'$(touch PWNED)'"'"'\'"'"''
source bin/activate.fish runs touch PWNED, and fish prints no error. The same payload as a directory name runs through VIRTUAL_ENV. --prompt . takes the current directory's name, so running virtualenv inside a directory someone else named is enough. Without the backslash the payload runs nothing, and under bash it runs nothing either.
virtualenv generates activate.fish by default. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.
The bug affects every release up to 21.14.1 that ships activate.fish. The GHSA-p58f-9548-mpm2 fix in 21.7.13 moved the placeholders outside their quotes but kept shlex.quote.
Patches
Fixed in 21.14.2. activate.fish now escapes backslashes and single quotes the way fish reads them, so the example above runs nothing and shows the prompt as given. Fix: pypa/virtualenv@3bddeaf
Workarounds
Do not create an environment whose path or prompt contains a backslash, and inspect activate.fish before you source one you did not create.
Credits
Kevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.
References
Kwstubbs Reporter
gaborbernat Remediation developer
Impact
FishActivatordefines noquote(), so it inheritsViaTemplateActivator.quote, which returnsshlex.quote(string). That function follows POSIXshrules, where a backslash inside single quotes stays a literal character. fish reads\'inside single quotes as an escaped quote and\\as an escaped backslash. A value with a backslash before a quote therefore ends the literal somewhere other than whereshlex.quoteput the end, and fish expands the command substitution that follows.The environment path reaches
set -gx VIRTUAL_ENV, and--promptorVIRTUALENV_PROMPTreachesset -gx VIRTUAL_ENV_PROMPT. For--prompt "x\'\$(touch PWNED)'\'", the generatedactivate.fishcontains:source bin/activate.fishrunstouch PWNED, and fish prints no error. The same payload as a directory name runs throughVIRTUAL_ENV.--prompt .takes the current directory's name, so running virtualenv inside a directory someone else named is enough. Without the backslash the payload runs nothing, and under bash it runs nothing either.virtualenv generates
activate.fishby default. An attacker needs to influence the environment path or prompt: a CI job or wrapper tool that passes a branch, project or job name through, or a directory in a cloned repository or unpacked archive.The bug affects every release up to 21.14.1 that ships
activate.fish. The GHSA-p58f-9548-mpm2 fix in 21.7.13 moved the placeholders outside their quotes but keptshlex.quote.Patches
Fixed in 21.14.2.
activate.fishnow escapes backslashes and single quotes the way fish reads them, so the example above runs nothing and shows the prompt as given. Fix: pypa/virtualenv@3bddeafWorkarounds
Do not create an environment whose path or prompt contains a backslash, and inspect
activate.fishbefore you source one you did not create.Credits
Kevin Stubbings (@Kwstubbs) of GitHub Security Lab reported this issue.
References