Security issue in uacme.sh

[Peter Conrad]

uacme/uacme.sh

Line 39 in 5afdaf0

 printf "%s" "${AUTH}" > "${CHALLENGE_PATH}/${TOKEN}" 

The externally controlled TOKEN variable (by the ACME server) is used to construct a path into which an externally controlled value $AUTH is written. This can be exploited by the ACME server to overwrite arbitrary files with arbitrary content.

[Peter Conrad]

That was fast, thanks!