[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-id: <330033C2-D929-4392-ADA6-374430E648DB@me.com>
Date: Thu, 30 Jan 2014 13:22:26 -0500
From: "Larry W. Cashdollar" <larry0@...com>
To: oss-security@...ts.openwall.com
Subject: echor 0.1.6 Ruby Gem exposes login credentials
Title: echor 0.1.6 Ruby Gem exposes login credentials
Date: 1/14/2014
CVE: Please assign one.
Author: Larry W. Cashdollar, @_larry0
Download: http://rubygems.org/gems/echor
Description: Echo ruby wrapper
Vulnerability
in file echor-0.1.6/lib/echor/backplane.rb:
The function perform_request passes sensitive data to the shell and unsanitized user input, if this gem is used in a rails application a user could get remote command injection simply by putting a semi-colon in their username or password. At a minimum a local user can steal the login credentials just by watching the process table on the system.
45 def perform_request(data)
46 JSON.parse(`curl -u
{Echo.backplane_user}:
{Echo.backplane_password} --data-binary '#{data}' #{@...nnel}`)
47 end
Vendor: Not notified, I don't think this Gem is maintained anymore.
Advisory: http://www.vapid.dhs.org/advisories/echor-expose-login-creds.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
