Google::Auth vulnerabilities

Google::Auth for Perl before version 0.06 runs a command named in an external_account credentials JSON via an ungated system call. The Pluggable subclass reads credential_source.executable.command and runs it as `system($command)`, passing the whole string to /bin/sh -c. No opt-in gate guards the call, and the path is reached from the standard Application Default Credentials flow.

Google::Auth versions 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. A local attacker can submit an authorization code for their own Google account, and the CLI exchanges it and stores the refresh token as the user's credentials.

Google::Auth version 0.12 for Perl allows server-side request forgery via unvalidated credential_source URLs in AWS external account credentials. The Aws class sends GET and PUT requests to the imdsv2_session_token_url, url and region_url fields without the host check applied by other credential classes.

Vulnerability in Google::Auth for Perl before version 0.09 allows SSRF and credential exfiltration. URLs taken from the credentials JSON are not validated against the universe domain, enabling requests to internal services and link-local endpoints with application credentials.