Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux

A recently identified security vulnerability in the official
Homebrew Cask repository could have been exploited by an attacker
to execute arbitrary code on users’ machines that have Homebrew
installed.

The issue, which was reported to the maintainers on April 18 by
a Japanese security researcher named RyotaK, stemmed from the way
code changes in its GitHub
repository^[1] were handled, resulting
in a scenario where a malicious pull request^[2]
— i.e., the proposed changes — could be automatically reviewed and
approved. The flaw was fixed on April 19.

Homebrew is a free and open-source software package manager
solution that allows the installation of software on Apple’s macOS
operating system as well as Linux. Homebrew Cask^[3] extends the
functionality to include command-line workflows for GUI-based macOS
applications, fonts, plugins, and other non-open source
software.

“The discovered vulnerability would allow an attacker to inject
arbitrary code into a cask and have it be merged automatically,”
Homebrew’s Markus Reiter said^[4]. “This is due to a flaw
in the git_diff dependency of the review-cask-pr
GitHub Action, which is used to parse a pull request’s diff for
inspection. Due to this flaw, the parser can be spoofed into
completely ignoring the offending lines, resulting in successfully
approving a malicious pull request.”

In other words, the flaw meant malicious code injected into the
Cask repository was merged without any review and approval.

The researcher also submitted a proof-of-concept (PoC) pull request^[5]
demonstrating the vulnerability, following which it was reverted.
In light of the findings, Homebrew has also removed the “automerge”
GitHub Action as well as disabled and removed the “review-cask-pr”
GitHub Action from all vulnerable repositories.

In addition, the ability for bots to commit to homebrew/cask*
repositories has been removed, with all pull requests requiring a
manual review and approval by a maintainer going forward. No user
action is required.

“If this vulnerability was abused by a malicious actor, it could
be used to compromise the machines that run brew before it gets
reverted,” the researcher said^[6]. “So I strongly feel
that a security audit against the centralized ecosystem is
required.”