Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 30 Jan 2014 13:22:26 -0500
From: "Larry W. Cashdollar" <>
Subject: echor 0.1.6 Ruby Gem exposes login credentials

Title: echor 0.1.6 Ruby Gem exposes login credentials

Date: 1/14/2014

CVE: Please assign one.

Author: Larry W. Cashdollar, @_larry0


Description: Echo ruby wrapper

in file echor-0.1.6/lib/echor/backplane.rb:
The function perform_request passes sensitive data to the shell and unsanitized user input, if this gem is used in a rails application a user could get remote command injection simply by putting a semi-colon in their username or password. At a minimum a local user can steal the login credentials just by watching the process table on the system.

 45     def perform_request(data)
 46       JSON.parse(`curl -u 
{Echo.backplane_password}     --data-binary '#{data}' #{@...nnel}`)
 47     end

Vendor: Not notified, I don't think this Gem is maintained anymore.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.