Remote code execution in Homebrew by compromising the official Cask repository

Re:Remote code execution in Homebrew by compromising the off... by theptip on Saturday April 24, 2021 @11:56AM (#26925863)

> After that, I received I can’t add a test cask just for this but you could try to make a harmless modification to an existing cask perhaps? from the staff. Therefore, I chose a random cask and decided to make harmless changes.

Yikes. And indeed this “harmless modification” did leak into a user-facing change.

Seems like questionable judgement from the brew security team here. Surely they should have a staging/test cask for hackers to attack. The lack of concern at pointing a hacker to make a real change to an arbitrary cask is worrying.

[ Parent | on HN ]

Re:Remote code execution in Homebrew by compromising the off... by myolxid1 on Saturday April 24, 2021 @12:16PM (#26926021)

It is likely that you'd have seen it anyway, as `brew update` loads casks whether or not installed. Note that this happened only to people who tapped the cask repo.

Turning off the autoupdate is highly not recommended - you don't get security updates for the software you install and you may experience issues with Homebrew. Chances are you'd have run `brew update` before you wanted to install/upgrade packages.

The best thing to happen here is for auto reviewing to be turned off and I'm glad for it as a daily user. Perhaps a much larger change (for Homebrew 4.0?) would be to avoid loading these .rb files on update, perhaps use an online cache/API like formulae.brew.sh.

[ Parent | on HN ]