full-disclosure - [FD] Shell Injection in Pygments FontManager._get_nix_font_path

Open Source and information security mailing list archives

Message-Id: <20150928172741.9154E138B19@mail.altsci.com>
Date: Mon, 28 Sep 2015 17:27:41 -0000
From: Javantea <jvoss@...sci.com>
To: FD <fulldisclosure@...lists.org>
Subject: [FD] Shell Injection in Pygments FontManager._get_nix_font_path

Shell Injection in Pygments FontManager._get_nix_font_path

Product:    Pygments
Version:    1.2.2-2.0.2 497:fe62167596bb to 3693:655dbebddc23 Tue Nov 06 17:30:45 2007 +0000 to Aug 21, 2015.
Website:    http://pygments.org/
Bitbucket:  https://bitbucket.org/birkenfeld/pygments-main
CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Discovery: Aug 21, 2015

An unsafe use of string concatenation in a shell string occurs in FontManager. If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system. The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options.

pygments/formatters/img.py:82

    def _get_nix_font_path(self, name, style):
        try:
            from commands import getstatusoutput
        except ImportError:
            from subprocess import getstatusoutput
        exit, out = getstatusoutput('fc-list "%s:style=%s" file' %
                                    (name, style))
        if not exit:
            lines = out.splitlines()
            if lines:
                path = lines[0].strip().strip(':')
                return path

https://bitbucket.org/birkenfeld/pygments-main/src/655dbebddc23943b8047b3c139c51c22ef18fd91/pygments/formatters/img.py?at=default&fileviewer=file-view-default#img.py-82

Recommendation

shlex.quote should be used to ensure that an attacker cannot inject commands.
https://docs.python.org/3/library/shlex.html#shlex.quote

A pull request has been made since the author did not respond to e-mail, Twitter, or IRC.
https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff

Regards,
Javantea

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives