[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 23 Jun 2024 08:41:15 +0000
From: Ihor Radchenko <yantar92@...teo.net>
To: oss-security@...ts.openwall.com
Subject: Arbitrary shell command evaluation in Org mode (GNU Emacs)
Hi,
Here is a vulnerability in Emacs Org mode.
Reproducer is the following .org file:
#+LINK: shell %(shell-command-to-string)
[[shell:touch ~/hacked.txt]]
When sent by email and previewed in Emacs or when opened in Emacs as a
file, the above Org file will evaluate "touch ~/hacked.txt" without any
prompts.
The fix is attached. It is against Org mode git repository.
The fix can be applied to older versions of Org mode/Emacs if deemed
necessary.
The fix has been included into Emacs 29.4 and Org 9.7.5 (released
yesterday).
View attachment "v3-0001-org-link-expand-abbrev-Do-not-evaluate-arbitrary-.patch" of type "text/x-patch" (2931 bytes)
--
Ihor Radchenko // yantar92,
Org mode contributor,
Learn more about Org mode at <https://orgmode.org/>.
Support Org development at <https://liberapay.com/org-mode>,
or support my work at <https://liberapay.com/yantar92>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
