DNS SRV lookup of file:// sources enables local hijacking of gems
该报告还没有中文解读。
原文摘录
摘自原文（6446 字符中的一小部分）
`gem` makes a DNS SRV query for each of its configured sources; the response is allowed to override the source URL in certain ways. The SRV query happens not only for http:// and https:// sources, but also for s3:// and file://. In the case of file://, the SRV response may add a prefix to the local …
原文中的代码
victim$ mkdir -p /home/victim/trusted-gem-path/gems victim$ (cd /home/victim/trusted-gem-path/gems && gem fetch --clear-sources --source https://rubygems.org/ minitest) victim$ gem generate_index -d /home/victim/trusted-gem-path
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 RubyGems 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @b9629eebd06fb8f0680ecbdef829e · 版权归作者与 RubyGems 所有