[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-id: <16C7FA0D-D5C1-4691-8B33-8B3AE558B8A3@me.com>
Date: Tue, 15 Apr 2014 20:02:54 -0400
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Remote Command Injection in Ruby Gem sfpagent 0.4.14
Title: Remote Command Injection in Ruby Gem sfpagent 0.4.14
Date: 4/15/2014
Author: Larry W. Cashdollar, @_larry0
CVE: Please assign one at your leisure.
Download: http://rubygems.org/gems/sfpagent
Vulnerability
The list variable generated from the user supplied JSON[body] input is passed directly to the system() shell on line 649. If a user supplies a module name with shell metacharacters like ; they might be able to execute shell commands on the remote system as the sfpagent running user id.
I think to fix this youâ€TMd need to sanitize all input from the user with shellwords.escape.
637 code, body = get_data(address, port, '/modules')
638 raise Exception, "Unable to get modules list from {name}" if code.to_i != 200
639
640 modules = JSON[body]
641 list = ''
642 schemata.each { |m|
643 list += "{m} " if File.exist?("{modules_dir}/{m}") and
644 (not modules.has_key?(m) or modules[m] != get_local_module_hash(m, modules_dir).to_s)
645 }
646
647 return true if list == ''
648
649 if system("cd #{modules_dir}; #{install_module} #{address} #{port} #{list} 1>/dev/null 2>/tmp/install_module.error")
650 Sfp::Agent.logger.info "Push modules #{list}to #{name} [OK]"
651 else
652 Sfp::Agent.logger.warn "Push modules #{list}to #{name} [Failed]"
653 end
654
655 return true
Vendor: Notified 4/15/14. Version 0.4.15 fixes this issue.
Advisory: http://www.vapid.dhs.org/advisories/spfagent-remotecmd.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
