Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 10 Mar 2014 16:33:12 -0400
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem

Title: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem

Author: Larry W. Cashdollar, @_larry0

Download Site: http://rubygems.org/gems/Arabic-Prawn

Date: 12/17/2013

CVE: Please assign.

Vendor Notified: 3/3/2014

In Arabic-Prawn-0.0.1/lib/string_utf_support.rb, the following lines pass unsanitized input to the shell.

426 var = %x{ /usr/bin/curl -I -L --fail --silent --connect-timeout #{seconds} --max-time #{seconds+10} # {url}; /bin/echo -n $? }.to_i 427

428             #return false unless var == 0
429             raise "Failed to create connection to web site: #{url}  --  curl error code: #{var}  --  " unless var     == 0
430 
431             str = %x{ /usr/bin/curl -L --fail --silent --connect-timeout #{seconds} --max-time #{seconds+10} #{ur    l} | \
432                       /usr/bin/grep -Eo -m 1 \"(charset|encoding)=[\\"']?[^\\"'>]+\" | /usr/bin/grep -Eo \"[^=\\"    '>]+$\" }

443             %x{ /usr/bin/touch #{downloaded_file} 2>/dev/null }
444             raise "No valid HTML download file (path) specified!" unless File.file?(downloaded_file)
445             %x{ /usr/bin/curl -L --fail --silent --connect-timeout #{seconds} --max-time #{seconds+10} -o #{downl    oaded_file} #{url} }
446 
447             simple_test = %x{ /usr/bin/file -ik #{downloaded_file} }    #  cf. man file

If the downloaded file name #{downloaded_file} or #{url} contains any shell meta characters like ';' a malicious user can inject shell commands.

PoC
myfile;id;.txt

id would be passed to the command line and executed.

Advisory: http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.