Path Traversal in App::Ack via .ackrc --files-from

Executive Summary

This vulnerability exists in App::Ack versions through 3.10.0 for Perl, where the program reads arbitrary files via the --files-from option in a project .ackrc configuration file.

Ack searches up the directory hierarchy from the current directory for a project .ackrc file and loads its options. However, the project-source option blocklist in App::Ack::ConfigLoader does not include the --files-from option, allowing a project .ackrc file to specify a path whose listed files ack then reads and searches.

Although version 3.10.0 added --follow to the blocklist, --files-from remains accepted, meaning a project .ackrc committed to an untrusted repository can cause ack to read files outside the project and print their matching lines.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to cause ack to read and output contents of arbitrary files outside the intended project scope.

If a project .ackrc file is committed to an untrusted repository with a malicious --files-from setting, ack may disclose sensitive or confidential information by reading files that should not be accessed.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid using App::Ack versions through 3.10.0 that accept the --files-from option in a project .ackrc file.

Specifically, ensure that project .ackrc files from untrusted repositories are not used, as they can cause ack to read arbitrary files outside the project.

Consider upgrading to a version of App::Ack that blocks the --files-from option or applying patches that add this option to the blocklist.

Useful 0 Not Useful 0