Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Apr 2013 19:14:43 +0000 (GMT)
From: "Larry W. Cashdollar" <>
To: Open Source Security <>
Subject: Remote command injection in Ruby Gem kelredd-pruview 0.3.8

´╗┐Remote command injection in Ruby Gem kelredd-pruview 0.3.8 ´╗┐

Larry W. Cashdollar

Description: "A gem to ease generating image previews (thumbnails) of various files."

Remote commands can be executed if the file name contains shell meta characters.


In the following code snippet, we see the user input isn't sanitized for shell metacharacters. A malicious file with special characters in the filename could be used to execute commands as the local user.

69       run_system_command("convert -format jpg \"{source}[0]\" \"{@...pfile.path}\"", "Error processing postscript document")
85       colorspace = run_system_command("identify #{GLOBAL_CMD_ARGS} -format \"%r\" #{image.path}", "Error reading document colorspace")

function run_system_comand() passes user supplied input to the command line.

141     def run_system_command(command, error_message)
142       output = `{command}`
143       raise "{error_message}: error given {$?}\n{output}" if $? != 0
144       return output
145     end

In kelredd-pruview-0.3.0/lib/pruview/video.rb: Also the video encoding and scaling features are vulnerable as well:

27       run("#{FLVTOOL} -U #{target}", "Unable to add meta-data for #{target}.")

51       run(build_command(@...rce, target, width, height, get_info(info_yml), scale_static), "Una    ble to convert #{@...rce} to #{target}.")

Run is defined as:

140     def run(command, error_message = "Unknown error.")
141       raise "Ffmpeg error: " + error_message + " - command: '#{command}'" if !system(command)
142     end

User controlled data is being sent to the command line with out any shell meta charatcers being escaped.

In kelredd-pruview-0.3.0/lib/pruview/video_image.rb:

13       run(build_command(source, "-ss 00:00:#{duration * 0.1}", 'mjpeg', target), "Unable to get     preview image for #{target}")

30 def self.build_command(source, time_str, format, target) 31 command = %Q{#{Video::FFMPEG} -i "#{source}"} 32 command += " #{time_str}" 33 command += " -f #{format}" if !format.empty? 34 command += " -an -y #{target}" 35 end

where function run() is defined as:

 37     def, error_message = "Unknown error.")
 38       raise "Ffmpeg error: " + error_message + " - command: '#{command}'" if !system(command)
 39     end 

In line 38 user supplied data is passed to the command line.
This vulnerability doesn't have a CVE assigned yet. 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ