[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-id: <6C1F1FB3-1345-48F9-AFA6-860AC3010464@me.com>
Date: Mon, 10 Mar 2014 16:33:12 -0400
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem
Title: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem
Author: Larry W. Cashdollar, @_larry0
Download Site: http://rubygems.org/gems/Arabic-Prawn
Date: 12/17/2013
CVE: Please assign.
Vendor Notified: 3/3/2014
In Arabic-Prawn-0.0.1/lib/string_utf_support.rb, the following lines pass unsanitized input to the shell.
426 var = %x{ /usr/bin/curl -I -L --fail --silent --connect-timeout #{seconds} --max-time #{seconds+10} # {url}; /bin/echo -n $? }.to_i 427
428 #return false unless var == 0
429 raise "Failed to create connection to web site: #{url} -- curl error code: #{var} -- " unless var == 0
430
431 str = %x{ /usr/bin/curl -L --fail --silent --connect-timeout #{seconds} --max-time #{seconds+10} #{ur l} | \
432 /usr/bin/grep -Eo -m 1 \"(charset|encoding)=[\\"']?[^\\"'>]+\" | /usr/bin/grep -Eo \"[^=\\" '>]+$\" }
443 %x{ /usr/bin/touch #{downloaded_file} 2>/dev/null }
444 raise "No valid HTML download file (path) specified!" unless File.file?(downloaded_file)
445 %x{ /usr/bin/curl -L --fail --silent --connect-timeout #{seconds} --max-time #{seconds+10} -o #{downl oaded_file} #{url} }
446
447 simple_test = %x{ /usr/bin/file -ik #{downloaded_file} } # cf. man file
If the downloaded file name #{downloaded_file} or #{url} contains any shell meta characters like ';' a malicious user can inject shell commands.
PoC
myfile;id;.txt
id would be passed to the command line and executed.
Advisory: http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
