CVE-2024-38448

What it actually does

Untrusted dbpath argument to htags permits injection of shell metacharacters resulting in arbitrary command execution with the privileges of the invoking user.

Why it matters to the business

Attackers can gain remote code execution on developer or build systems that invoke GNU Global with attacker-controlled paths, potentially leading to source-code theft, supply-chain tampering, or lateral movement.

How an attack unfolds

An attacker supplies a dbpath containing shell metacharacters to the htags utility; when htags processes the path it passes the value to a shell without sanitization, causing the injected commands to execute.

How to fix it

Upgrade GNU Global to a fixed package version on each affected distribution: Debian 11/12/13 to 6.6.12-1 or later; Ubuntu 20.04 LTS and derivative packages (linux-aws, linux-azure, linux-gcp, etc.) to the listed 5.x kernel or 6.6.12+ userspace packages.

How to confirm the fix worked

Confirm the installed global/htags binary reports version 6.6.12 or newer; re-run any automated build or indexing jobs that previously used untrusted dbpath values and verify no unexpected processes are spawned.

Typical attack path

1. Identify a service or script that invokes htags with a user- or network-supplied dbpath value
2. Craft a dbpath containing shell metacharacters that execute attacker-chosen commands
3. Trigger the vulnerable htags invocation
4. Obtain a shell or execute follow-on actions on the compromised host

How to detect it

Review process execution logs and audit trails for htags invocations that contain unusual characters in the -d/--dbpath argument; correlate with subsequent unexpected shell or network activity on the same host.

• htags.*-d.*[;&|`$]
• htags.*--dbpath.*[;&|`$]

What your security team should do

• Immediately update all affected Debian and Ubuntu systems to the fixed package versions listed for each distribution
• Scan source-code repositories and CI pipelines for direct or indirect use of htags with untrusted paths
• Add allow-listing or quoting around dbpath arguments in any custom scripts until patches are deployed
• Monitor package update channels for backports to older releases still in use