Description
hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
hashcat hashcat
Default version status: unaffected
0 to ≤ 7.1.2affected
References
- https://github.com/hashcat/hashcat/issues/4738 ↗
- https://github.com/hashcat/hashcat ↗
- https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4 ↗
- https://github.com/hashcat/hashcat/blob/v7.1.2/src/restore.c#L365-L369 ↗
- https://www.vulncheck.com/advisories/hashcat-through-arbitrary-file-write-via-restore-file-option-injection ↗