# Unsafe usage of Ruby string interpolation enabling command injection in git-fastclone

git-fastclone passes interpolated strings to Cocaine::CommandLine.new, so a malicious submodule URL in .gitmodules executes shell commands during clone.

- Payout: hidden
- Severity: high
- Program: Square Open Source
- Found by: bburky
- Disclosed: 2016-01-25
- CVE: CVE-2015-8969
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/105190
- Library page: https://bugbountylibrary.com/r/h1%3A105190
- Tags: area:oss domain:oss impact:rce kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:command-injection vuln:rce

**Target:** Ruby CLI tool (git-fastclone) using Cocaine::CommandLine
**Root cause:** Cocaine only escapes arguments interpolated via #run, not strings passed to CommandLine.new; git-fastclone builds commands with plain Ruby string interpolation, so attacker-controlled values like submodule URLs reach the shell unescaped.
**Steps:**
1. `git init cocaine-command-injection && cd cocaine-command-injection`
2. `git submodule add https://github.com/octocat/Hello-World malicious-submodule`
3. Overwrite .gitmodules url with `"'`cat /etc/passwd >&2`'"`
4. `git add .gitmodules && git commit -m 'Malicious Cocaine command injection submodule'`
5. `git fastclone cocaine-command-injection cocaine-command-injection-clone` triggers the injected command
**How found:** While reviewing git-fastclone source for a separate ext-protocol report, the researcher noticed Cocaine::CommandLine.new calls using plain Ruby string interpolation and recalled the Cocaine README warning that only #run arguments are escaped.
**Exploitation:** Attacker publishes a repo whose .gitmodules submodule URL contains shell metacharacters; when a victim runs git fastclone on it, the interpolated URL is passed to Cocaine::CommandLine.new and executed by the shell, running arbitrary commands as the victim.
**Insight:** When a wrapper library advertises injection protection, check whether the protection applies to the constructor or only the run/interpolation path; any value reaching CommandLine.new via Ruby interpolation (including repo metadata like .gitmodules URLs) is a shell injection sink.