I think the following two vulnerabilities are common in GitHub repositories: And I noticed that Homebrew/homebrew-* repository is in scope.Р”Р„s IРІР‚в„ўm not good at reading complicated Ruby codes, I decided to find a vulnerability in Homebrew/homebrew-*. To select the target, I looked at the policy page of the vulnerability disclosure program.

Then, I remembered that I saw a program named Homebrew on HackerOne, so I decided to find the vulnerability in it. One afternoon, I had a slight time before my next appointment 1, so I decided to look for an interesting program on HackerOne.Р”Р„s I wanted to find a vulnerability in the software/services I was using, I looked around on my PC, and the brew command caught my eyes. In the Homebrew/homebrew-cask repository, it was possible to merge the malicious pull request by confusing the library that is used in the automated pull request review script developed by the Homebrew project.Р”В«y abusing it, an attacker could execute arbitrary Ruby codes on users' machine who uses brew. If you found any vulnerabilities in Homebrew, please report it to Homebrew projectРІР‚в„ўs vulnerability disclosure program. This article describes a vulnerability assessment that is performed with permission from the Homebrew projectРІР‚в„ўs staff and is not intended to recommend you to perform an unauthorized vulnerability assessment. Homebrew project is running a РІР‚СљVulnerability Disclosure ProgramРІР‚Сњ on HackerOne, which allows hackers to perform the vulnerability assessment. (Official blog post about this incident is available here: ) Preface

Brew cask github