2 lines
3.0 KiB
JSON
2 lines
3.0 KiB
JSON
{"affected":[{"affectedData":[{"product":"prefecthq/prefect","vendor":"prefecthq","versions":[{"lessThanOrEqual":"latest","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security@huntr.dev"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the `reference` field. The `reference` field is concatenated directly into a `git clone` command string without proper sanitization, and then parsed by `shlex.split()`. This enables injection of options such as `-c`, leading to potential Server-Side Request Forgery (SSRF), credential theft, or remote code execution (RCE). The vulnerability affects both the `aget_directory()` and `get_directory()` methods in `src/integrations/prefect-github/prefect_github/repository.py`. This issue does not affect the GitLab and BitBucket integrations, which use a safer list-based command construction approach."},{"lang":"es","value":"Una vulnerabilidad en el bloque 'GitHubRepository' de la integración 'prefect-github' en la versión 3.6.18 de Prefect permite a un atacante inyectar opciones arbitrarias de línea de comandos de git a través del campo 'reference'. El campo 'reference' se concatena directamente en una cadena de comando 'git clone' sin una sanitización adecuada, y luego es analizado por 'shlex.split()'. Esto permite la inyección de opciones como '-c', lo que lleva a una posible falsificación de petición del lado del servidor (SSRF), robo de credenciales o ejecución remota de código (RCE). La vulnerabilidad afecta tanto a los métodos 'aget_directory()' como 'get_directory()' en 'src/integrations/prefect-github/prefect_github/repository.py'. Este problema no afecta a las integraciones de GitLab y BitBucket, que utilizan un enfoque de construcción de comandos basado en listas más seguro."}],"id":"CVE-2026-3515","lastModified":"2026-07-23T17:10:00.123","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.0"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"security@huntr.dev","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3515","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-26T15:08:15.183188Z","version":"2.0.3"}}]},"published":"2026-05-24T05:16:39.167","references":[{"source":"security@huntr.dev","url":"https://huntr.com/bounties/f3b048b8-7f4e-45ef-a5a7-cb841c39acde"}],"sourceIdentifier":"security@huntr.dev","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"security@huntr.dev","type":"Secondary"}]}
|