CVE-2022-20001 – This vulnerability in fish shell versions 3.1.0... (How to Fix)

Q: What is the severity of CVE-2022-20001?

CVE-2022-20001 has a CVSS score of 7.8 (HIGH). This vulnerability in fish shell versions 3.1.0-3.3.1 allows arbitrary code execution when users navigate to directories containing malicious git configuration. Attackers can exploit this by tricking users into accessing directories they control, such as on shared file systems or extracted archives. Users with default fish configurations are affected.

📋 TL;DR

This vulnerability in fish shell versions 3.1.0-3.3.1 allows arbitrary code execution when users navigate to directories containing malicious git configuration. Attackers can exploit this by tricking users into accessing directories they control, such as on shared file systems or extracted archives. Users with default fish configurations are affected.

💻 Affected Systems

Products:

fish shell

Versions: 3.1.0 through 3.3.1

Operating Systems: Linux, macOS, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects users with default fish configuration where fish_git_prompt is enabled in prompt.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with attacker gaining the same privileges as the user executing fish shell, potentially leading to data theft, ransomware deployment, or lateral movement.

🟠

Likely Case

Local privilege escalation or execution of malicious scripts in user context, potentially stealing credentials or sensitive files.

🟢

If Mitigated

No impact if fish_git_prompt is disabled or fish is patched to 3.4.0+.

🌐 Internet-Facing: LOW - Requires local directory access or file system interaction, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Shared file systems, network drives, or extracted archives could be used for internal attacks.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires user interaction (changing to malicious directory). Proof of concept exists in advisory references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.4.0

Vendor Advisory: https://github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mq

Restart Required: Yes

Instructions:

1. Update fish using package manager: 'sudo apt update && sudo apt upgrade fish' (Debian/Ubuntu) or 'brew upgrade fish' (macOS). 2. Restart terminal or source fish config: 'source ~/.config/fish/config.fish'. 3. Verify version with 'fish --version'.

🔧 Temporary Workarounds

Disable fish_git_prompt

all

Remove git prompt function to prevent automatic git command execution

functions -e fish_git_prompt

Disable automatic git info in prompt

all

Modify fish config to remove git prompt from display

Edit ~/.config/fish/config.fish and remove or comment out 'fish_git_prompt' from prompt definition

🧯 If You Can't Patch

Disable fish_git_prompt function using 'functions -e fish_git_prompt'
Avoid navigating to untrusted directories or shared file systems with fish shell

🔍 How to Verify

Check if Vulnerable:

Run 'fish --version' and check if version is between 3.1.0 and 3.3.1 inclusive.

Check Version:

fish --version

Verify Fix Applied:

Run 'fish --version' and confirm version is 3.4.0 or higher.

📡 Detection & Monitoring

Log Indicators:

Unusual git commands executed from fish shell prompts
Commands running from unexpected directories

Network Indicators:

None - local exploitation only

SIEM Query:

Process execution where parent process is fish and command contains unexpected git operations or shell commands

📊 Metadata

CVE ID: CVE-2022-20001

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-74

Published: March 14, 2022

Last Updated: November 21, 2024

🔗 References

https://github.com/fish-shell/fish-shell/pull/8589 Patch,Third Party Advisory
https://github.com/fish-shell/fish-shell/releases/tag/3.4.0 Release Notes,Third Party Advisory
https://github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mq Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPZ7JV22DSZB5LNUCUEJ2HO3PKM2TVVK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRNMYS2LKB6TKOOBQQRSRQICDMWLZ4QL/
https://security.gentoo.org/glsa/202309-10
https://www.debian.org/security/2022/dsa-5234 Third Party Advisory
https://github.com/fish-shell/fish-shell/pull/8589 Patch,Third Party Advisory
https://github.com/fish-shell/fish-shell/releases/tag/3.4.0 Release Notes,Third Party Advisory
https://github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mq Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPZ7JV22DSZB5LNUCUEJ2HO3PKM2TVVK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRNMYS2LKB6TKOOBQQRSRQICDMWLZ4QL/
https://security.gentoo.org/glsa/202309-10
https://www.debian.org/security/2022/dsa-5234 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-20001, you might also want to check these: