CVE-2021-3013

Vulnerability

In ripgrep versions before 13.0.0 on Windows, the -z/--search-zip and --pre flags do not properly sanitize executables resolved from the current working directory. This allows an attacker to place a malicious executable in a directory and trigger its execution when ripgrep processes files in that directory. The vulnerability is specific to the Windows platform due to how executable resolution interacts with the -z and --pre flags [3].

Exploitation

An attacker must be able to place a crafted executable in the current working directory from which a victim runs ripgrep with either the -z/--search-zip or --pre flag. The attacker does not need special privileges; any low-privilege user who can write files to that directory can set up the malicious executable. When the victim executes rg -z or rg --pre in that directory, ripgrep will invoke the executable without adequate validation, leading to arbitrary code execution [3].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running ripgrep. This compromises the confidentiality, integrity, and availability of the victim's system, potentially leading to full system compromise depending on the attacker's payload and the victim's privileges [3].

Mitigation

The vulnerability is fixed in ripgrep version 13.0.0, released on 2021-06-12 [1][3]. Users on Windows should update to ripgrep 13.0.0 or later immediately. There is no known workaround other than avoiding use of the -z/--search-zip and --pre flags in untrusted directories on Windows until the update is applied.