CVE-2022-39245: Untrusted Search Path (CWE-426)
value: Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow a local user to run arbitrary commands on the user's system with root permissions. Versions 0.9.5 and later contain a patch. No known workarounds exist.
CWE description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CVSS v3 base score: 7.8
Published: 2022-09-26T14:15Z
Repository: https://github.com/makedeb/mist
Language: Other
Files changed: CHANGELOG.md, Cargo.lock, Cargo.toml, makedeb/PKGBUILD, src/util.rs
Commit date: 2022-09-25 23:58:44 -0500
Commit message: Ensure 'sudo' binary used for permission checks isn't user supplied

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 121090d..280fb6f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,10 +4,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.9.5] - 2022-09-25
+### Security
+- Ensure `sudo` binary used for permission checks isn't one supplied by the user in the `PATH` variable.
+
 ## [0.9.4] - 2022-09-25
 ### Fixed
 - Ensure cache directories exist before they're used.
 
 ## [0.9.3] - 2022-09-25
diff --git a/Cargo.lock b/Cargo.lock
index edc7f21..8a24ba7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -861,11 +861,11 @@ dependencies = [
  "windows-sys",
 ]
 
 [[package]]
 name = "mist"
-version = "0.9.4"
+version = "0.9.5"
 dependencies = [
  "bat",
  "chrono",
  "clap",
  "colored",
diff --git a/Cargo.toml b/Cargo.toml
index 2ddba98..a223fa8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,8 +1,8 @@
 [package]
 name = "mist"
-version = "0.9.4"
+version = "0.9.5"
 authors = ["Hunter Wittenborn <hunter@hunterwittenborn.com"]
 description = "The official command-line interface for the makedeb Package Repository"
 edition = "2021"
 homepage = "https://github.com/makedeb/mist"
 repository = "https://github.com/makedeb/mist"
diff --git a/makedeb/PKGBUILD b/makedeb/PKGBUILD
index 1963adc..ff22ef2 100644
--- a/makedeb/PKGBUILD
+++ b/makedeb/PKGBUILD
@@ -2,11 +2,11 @@
 
 # NOTE: If you're installing this from the MPR you'll need to pass
 # `-H 'MPR-Package: yes'` to your `makedeb` call if you want Mist to be able to
 # automatically update itself.
 pkgname=mist
-pkgver=0.9.4
+pkgver=0.9.5
 pkgrel=1
 pkgdesc='The official command-line interface for the makedeb Package Repository'
 arch=('any')
 depends=(
     'libapt-pkg-dev'
diff --git a/src/util.rs b/src/util.rs
index 324f5a8..1cc95ad 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -333,11 +333,11 @@ pub mod sudo {
     }
 
     pub fn check_perms() {
         super::message::info("Obtaining root permissions...\n");
 
-        let mut cmd = self::run_as_normal_user("sudo");
+        let mut cmd = self::run_as_normal_user("/usr/bin/sudo");
         cmd.arg("true");
 
         if !cmd.spawn().unwrap().wait().unwrap().success() {
             super::message::error("Couldn't obtain root permissions.\n");
             quit::with_code(exitcode::USAGE);
@@ -349,11 +349,11 @@ pub mod sudo {
     //     users::switch::set_effective_uid(*self::NORMAL_UID).unwrap();
     // }
 
     // Run a command as the normal user declared by [`NORMAL_UID`].
     pub fn run_as_normal_user<P: AsRef<super::OsStr>>(program: P) -> super::ProcCommand {
-        let mut cmd = super::ProcCommand::new("sudo");
+        let mut cmd = super::ProcCommand::new("/usr/bin/sudo");
         cmd.args(["-E", "-n"]);
         cmd.arg(format!("-u#{}", *self::NORMAL_UID));
         cmd.arg("--");
         cmd.arg(program);
         cmd

Vulnerable code: version = "0.9.4"
version = "0.9.4"
pkgver=0.9.4
        let mut cmd = self::run_as_normal_user("sudo");
        let mut cmd = super::ProcCommand::new("sudo");
Fixed code: ## [0.9.5] - 2022-09-25
### Security
- Ensure `sudo` binary used for permission checks isn't one supplied by the user in the `PATH` variable.

version = "0.9.5"
version = "0.9.5"
pkgver=0.9.5
        let mut cmd = self::run_as_normal_user("/usr/bin/sudo");
        let mut cmd = super::ProcCommand::new("/usr/bin/sudo");