CVE-2018-12356 Breaking signature verification in pass (Simple Password Store)

[Marcus Brinkmann <marcus.brinkmann () ruhr-uni-bochum de>]

This is the third (and for now last) in my series of GnuPG signature
spoof exploits.

First, a cautious note:

In the course of my 2 week investigation, I went through a lot of
applications using gpg. There were a couple of "near misses" in critical
infrastructure projects which were not vulnerable, but where I am not
sure if that was due to conscious design choices or just by pure chance.

It would be prudent for everybody who knows a script or package using
gpg to have a look for issues with status-fd, regular expressions and/or
"gpg -d | some-other-program" patterns.

Now, the details about CVE-2018-12356:

I found a critical vulnerability in pass, the Simple Password Store:

CVE-2018-12356: An issue was discovered in password-store.sh in pass in
Simple Password Store 1.7 through 1.7.1. The signature verification
routine parses the output of GnuPG with an incomplete regular
expression, which allows remote attackers to spoof file signatures on
configuration files and extensions scripts. Modifying the configuration
file allows the attacker to inject additional encryption keys under
their control, thereby disclosing passwords to the attacker. Modifying
the extension scripts allows the attacker arbitrary code execution.

I am also calling out the missing integrity protection in pass for
password files, making pass users potentially vulnerable to a broad
range of attacks.

https://neopg.io/blog/pass-signature-spoof/