Browsertrix
Monthly
Authenticated Browsertrix users who hold crawler or administrator permission on an org can execute arbitrary operating-system commands inside the backend pod by submitting a crafted Git URL to the Custom Behaviors validation endpoint, affecting versions 1.15.0 through 1.22.7. The pre-fix code built a shell command string by interpolating the user-supplied repository URL into 'git ls-remote', so shell metacharacters in that URL were interpreted by the shell and ran with the backend pod's privileges; the vendor advisory notes that open registration or hosted free-trial access can make the required role broadly obtainable, materially lowering the barrier. No public exploit code has been identified at time of analysis, and the issue is remediated in the vendor-released version 1.22.8, which switches to argument-list subprocess execution, adds a 30-second timeout, disables git credential prompts, and drops privileges to nobody (uid/gid 65534).
Authenticated Browsertrix users who hold crawler or administrator permission on an org can execute arbitrary operating-system commands inside the backend pod by submitting a crafted Git URL to the Custom Behaviors validation endpoint, affecting versions 1.15.0 through 1.22.7. The pre-fix code built a shell command string by interpolating the user-supplied repository URL into 'git ls-remote', so shell metacharacters in that URL were interpreted by the shell and ran with the backend pod's privileges; the vendor advisory notes that open registration or hosted free-trial access can make the required role broadly obtainable, materially lowering the barrier. No public exploit code has been identified at time of analysis, and the issue is remediated in the vendor-released version 1.22.8, which switches to argument-list subprocess execution, adds a 30-second timeout, disables git credential prompts, and drops privileges to nobody (uid/gid 65534).