# Double evaluation in .bash_prompt of dotfiles allows a malicious repository to execute arbitrary commands

dotfiles .bash_prompt embeds git branch names into PS1, so a repo with a branch named $(touch${IFS}/tmp/pwned) executes commands on cd.

- Payout: hidden
- Severity: high
- Program: Ian Dunn
- Found by: ryotak
- Disclosed: 2022-12-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1785378
- Library page: https://bugbountylibrary.com/r/h1%3A1785378
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:high technique:source-review vuln:command-injection vuln:rce

**Target:** .bash_prompt shell prompt script (bash PS1)
**Root cause:** vcs_prompt output (git branch name) is interpolated into PS1 via command substitution at assignment time, and PS1 itself re-evaluates command substitutions each prompt render, so attacker-controlled branch names are executed.
**Steps:**
1. Install dotfiles so .bash_prompt is sourced.
2. `git init -b '$(touch${IFS}/tmp/pwned)' repo`
3. `cd repo`
4. Prompt renders and `touch /tmp/pwned` executes.
**How found:** Noticed PS1 supports command substitution and that .bash_prompt assigns PS1 using `$(vcs_prompt)`, whose output includes untrusted git/svn metadata; hypothesized a crafted branch name would be re-evaluated.
**Exploitation:** Attacker publishes a repo whose branch name contains `$(...)` command substitution; victim cd's into the cloned repo, the prompt is rebuilt with the branch name embedded in PS1, and bash evaluates the substitution on each prompt display, running attacker commands as the victim.
**Insight:** Any prompt framework that builds PS1 from VCS metadata (branch, tag, remote, svn info) is a double-evaluation sink: test with branch names containing `$(...)`, backticks, and `${IFS}` to bypass space filtering.