GSD-2021-1000009

    Dashboard / Vulnerabilities / GSD-2021-1000009

    GSD-2021-1000009

    Published: 31 May 2021Last Modified: 14 Mar 2023

    Summary: Replacement of bash script by an attacker to one that includes malicious commands in Codecov Bash uploader version All versions downloaded from Jan 2021 through April 2021. Because the attacker had control of the script the version # included in it cannot be trusted.

    Details: In Codecov Codecov Bash uploader version All versions downloaded from Jan 2021 through April 2021. Because the attacker had control of the script the version # included in it cannot be trusted. a Replacement of bash script by an attacker to one that includes malicious commands exists in the The Bash uploader script that can be attacked via Numerous victims downloaded and executed this script, resulting in Information disclosure is known, other impacts may have occurred (it is not clear if the script was only replaced once or multiple times)

    References: https://www.securityweek.com/codecov-bash-uploader-dev-tool-compromised-supply-chain-hack, https://about.codecov.io/security-update/, https://docs.codecov.io/docs/about-the-codecov-bash-uploader, https://www.reuters.com/technology/us-investigators-probing-breach-san-francisco-code-testing-company-firm-2021-04-16/, https://mobile.twitter.com/_fel1x/status/1383050036397871108

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GSD-2021-1000009 | CVE-DB