SG-001: Hook RCE
Severity: CRITICAL
Shell commands in hooks object that can achieve RCE
Fires when
- A hook's command pipes a curl or wget fetch straight into a shell interpreter (curl | sh, wget | bash, remote fetch-and-exec).
- A hook's command decodes base64 and pipes it to a shell, or evals the output of a fetched URL.
- A hook's command opens a netcat reverse shell.
- A hook's command fetches a payload to a system temp path, or makes a file executable and then fetches/runs it (chmod +x + fetch/temp run).
Related CVEs
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.