Collected research
RCE in Homebrew by compromising the official Cask repository
Remote code execution in Homebrew by compromising the official Cask repository
Homebrew's cask repository auto-approved pull requests using the git_diff Ruby gem, whose parser treats an added line matching a b/path pattern as file metadata rather than a content change. A pull request could therefore look like a zero-line edit, pass the review bot, be merged automatically, and run arbitrary Ruby on every machine that ran brew.
Record
- Document
- Remote code execution in Homebrew by compromising the official Cask repository
- Researcher
- RyotaK
- Published by
- blog.ryotak.net
- Date
- Topic
- Supply
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of RyotaK, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .