SECURING INTERNET CRITICAL SOFTWARE: HOW WE COULD HAVE BACKDOORED BASH

Summary from the TLDR InfoSec newsletter

Researchers at Hacktron discovered a command injection vulnerability in GNU Savannah that let them gain root and take over user accounts, including a Bash maintainer. The vulnerability stemmed from the GPG key validator inserting a user's email address directly into commands it executed without sanitizing the input. The attackers utilized this vulnerability to install a webshell, read the database password, set their account to a superuser, impersonate other users, and also escalate privileges by exploiting GemOver(lay).