Command Injection

Vulnerability

The cocoapods-downloader Ruby gem prior to version 1.6.2 is vulnerable to command injection via argument injection in the Mercurial (hg) downloader. When the download function is invoked for an hg source, parameters such as url, revision, tag, or branch are passed to the hg clone command without proper sanitization, allowing an attacker to inject additional flags and arbitrary commands [1][2].

Exploitation

An attacker must supply a crafted hg source URL (or revision/tag/branch option) that includes Mercurial command-line flags. When the downloader executes hg clone with the attacker-controlled parameters, the extra flags can be used to perform command injection. This requires the user of the library to download a package from an untrusted source, such as a malicious CocoaPods spec [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the machine where cocoapods-downloader is used. The commands run with the privileges of the user invoking the downloader, leading to potential full compromise of the development or CI environment [1][2].

Mitigation

The vulnerability is fixed in cocoapods-downloader version 1.6.2, released on 2022-03-28 [1][2][4]. Users should upgrade to 1.6.2 or later. The fix ensures that invalid input is checked inside the download function before constructing the shell command [4]. No workaround is available.