lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 11 Apr 2013 20:19:21 +0000 (GMT)
From: "Larry W. Cashdollar" <larry0@...com>
To: full <full-disclosure@...ts.grok.org.uk>
Subject: Remote command injection in Ruby Gem
	kelredd-pruview 0.3.8

´╗┐Remote command injection in Ruby Gem kelredd-pruview 0.3.8 ´╗┐

Larry W. Cashdollar
4/4/2013
@_larry0

Description: "A gem to ease generating image previews (thumbnails) of various files."

https://rubygems.org/gems/kelredd-pruview

Remote commands can be executed if the file name contains shell meta characters.

./kelredd-pruview-0.3.0/lib/pruview/document.rb

In the following code snippet, we see the user input isn't sanitized for shell metacharacters. A malicious file with special characters in the filename could be used to execute commands as the local user.

69       run_system_command("convert -format jpg \"{source}[0]\" \"{@...pfile.path}\"", "Error processing postscript document")
85       colorspace = run_system_command("identify #{GLOBAL_CMD_ARGS} -format \"%r\" #{image.path}", "Error reading document colorspace")

function run_system_comand() passes user supplied input to the command line.

141     def run_system_command(command, error_message)
142       output = `{command}`
143       raise "{error_message}: error given {$?}\n{output}" if $? != 0
144       return output
145     end

In kelredd-pruview-0.3.0/lib/pruview/video.rb: Also the video encoding and scaling features are vulnerable as well:

27       run("#{FLVTOOL} -U #{target}", "Unable to add meta-data for #{target}.")

51       run(build_command(@source, target, width, height, get_info(info_yml), scale_static), "Una    ble to convert #{@...rce} to #{target}.")

Run is defined as:

140     def run(command, error_message = "Unknown error.")
141       raise "Ffmpeg error: " + error_message + " - command: '#{command}'" if !system(command)
142     end

User controlled data is being sent to the command line with out any shell meta charatcers being escaped.

In kelredd-pruview-0.3.0/lib/pruview/video_image.rb:

13       run(build_command(source, "-ss 00:00:#{duration * 0.1}", 'mjpeg', target), "Unable to get     preview image for #{target}")

30 def self.build_command(source, time_str, format, target) 31 command = %Q{#{Video::FFMPEG} -i "#{source}"} 32 command += " #{time_str}" 33 command += " -f #{format}" if !format.empty? 34 command += " -an -y #{target}" 35 end

where function run() is defined as:

 37     def self.run(command, error_message = "Unknown error.")
 38       raise "Ffmpeg error: " + error_message + " - command: '#{command}'" if !system(command)
 39     end 

In line 38 user supplied data is passed to the command line.
This vulnerability doesn't have a CVE assigned yet.

http://vapid.dhs.org/advisories/kelredd-pruview-cmd-inject.html 
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists