# OS Command Injection via egrep in Rake::FileList

Rake::FileList#egrep passes filenames starting with '|' to egrep, which treats them as shell commands, enabling OS command injection.

- Payout: hidden
- Severity: medium
- Program: Ruby
- Found by: kyoshida
- Disclosed: 2019-08-29
- CVE: CVE-2020-8130
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/651518
- Library page: https://bugbountylibrary.com/r/h1%3A651518
- Tags: area:oss domain:oss impact:rce kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:command-injection vuln:rce

**Target:** Rake::FileList#egrep in Ruby rake library
**Root cause:** FileList#egrep builds an egrep command line including filenames; egrep interprets a filename beginning with '|' as a shell command to execute rather than a file path.
**Steps:**
1. Create a file named `| touch evil.txt` in the working directory
2. Run `list = Rake::FileList.new(Dir.glob('*'))` then `list.egrep(/something/)`
3. egrep treats `| touch evil.txt` as a command and executes it, creating evil.txt
**How found:** Noticed that egrep accepts '|'-prefixed arguments as commands and that FileList passes raw filenames to egrep.
**Exploitation:** Attacker must place a file with a '|'-prefixed name in the target directory; when a victim runs egrep over the FileList, the embedded command executes with the victim's privileges.
**Insight:** When a library shells out to grep/egrep with user-influenced filenames, a leading '|' turns the argument into a command; test file-listing helpers with pipe-prefixed filenames.