CVE-2021-36376
📋 TL;DR
This vulnerability in dandavison delta on Windows allows path traversal attacks by resolving executable paths relative to the current directory instead of using absolute paths. Attackers could trick delta into executing malicious binaries placed in unexpected locations. Only Windows users of delta versions before 0.8.3 are affected.
💻 Affected Systems
- dandavison delta
📦 What is this software?
Delta by Delta Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution if an attacker can place malicious executables in directories delta might access, potentially leading to full system compromise.
Likely Case
Local privilege escalation or arbitrary code execution when users run delta from untrusted directories containing malicious executables.
If Mitigated
Limited impact with proper directory permissions and user awareness, restricting execution to trusted paths only.
🎯 Exploit Status
Requires ability to place malicious executables in directories delta might access; exploitation depends on user behavior and directory permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.3
Vendor Advisory: https://github.com/dandavison/delta/releases/tag/0.8.3
Restart Required: No
Instructions:
1. Update delta to version 0.8.3 or later using your package manager or from GitHub releases. 2. Verify installation with 'delta --version'. 3. No restart required as delta is a command-line tool.
🔧 Temporary Workarounds
Use absolute paths for delta execution
windowsAlways run delta from trusted directories or specify full paths to avoid relative path resolution issues.
Restrict directory permissions
windowsLimit write permissions to directories where delta might be executed to prevent malicious executable placement.
🧯 If You Can't Patch
- Avoid running delta from untrusted directories or directories with unknown executable files.
- Implement strict directory permissions and monitoring for unexpected executable creation in delta-accessible paths.
🔍 How to Verify
Check if Vulnerable:
Check delta version with 'delta --version' and verify if it's below 0.8.3 on Windows.Check Version:
delta --versionVerify Fix Applied:
After updating, confirm version is 0.8.3 or higher with 'delta --version'.📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from delta, especially from non-standard directories
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Process creation where parent process is delta.exe and executable path contains relative path indicators like '..' or './'🔗 References
- https://github.com/dandavison/delta/commit/f01846bd443aaf92fdd5ac20f461beac3f6ee3fd
- https://github.com/dandavison/delta/releases/tag/0.8.3
- https://vuln.ryotak.me/advisories/54
- https://github.com/dandavison/delta/commit/f01846bd443aaf92fdd5ac20f461beac3f6ee3fd
- https://github.com/dandavison/delta/releases/tag/0.8.3
- https://vuln.ryotak.me/advisories/54
