[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 08 Apr 2013 12:56:01 +0000 (GMT)
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4
Remote Command Injection Karteek Docsplit 0.5.4
4/1/2013
Larry W. Cashdollar
@_larry0
User supplied input isn't sanitized against shell metacharacters and is fed directly to the shell. If the user is tricked into extracting a file with shell characters in the name code can be executed remotely.
https://rubygems.org/gems/karteek-docsplit
./karteek-docsplit-0.5.4/lib/docsplit/text_extractor.rb
59 def extract_from_ocr(pdf, pages)
60 tempdir = Dir.mktmpdir
61 base_path = File.join(@output, @pdf_name)
62 if pages
63 pages.each do |page|
64 tiff = "{tempdir}/{@..._name}{page}.tif"
65 file = "{basepath}{page}"
66 run "MAGICKTMPDIR={tempdir} OMP_NUM_THREADS=2 gm convert -despeckle +adjoin #{MEMORY_ARGS} #{OCR_FLAGS} {pdf}[{page - 1}] #{tiff} 2>&1"
67 run "tesseract #{tiff} {file} -l eng 2>&1"
68 clean_text(file + '.txt') if @clean_ocr
69 FileUtils.remove_entry_secure tiff
70 end
71 else
72 tiff = "{tempdir}/{@..._name}.tif"
73 run "MAGICK_TMPDIR={tempdir} OMP_NUM_THREADS=2 gm convert -despeckle #{MEMORY_ARGS} #{OCR_FLAGS} #{pdf} #{tiff} 2>&1"
74 run "tesseract #{tiff} #{base_path} -l eng 2>&1"
75 clean_text(base_path + '.txt') if @clean_ocr
76 end
Run is defined as:
94 def run(command)
95 result = `#{command}`
96 raise ExtractionFailed, result if $? != 0
97 result
98 end
This vulnerability doesn't have a CVE yet assigned.
http://vapid.dhs.org/advisories/karteek-docsplit-cmd-inject.html
Content of type "text/html" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
