Loading HuntDB...

Unix domain socket and a path containing a null character

R
Ruby
Submitted None
Reported by ooooooo_q

Vulnerability Details

Technical details and impact analysis

Improper Access Control - Generic
Some methods on UNIX domain socket are not checked for null characters. ``` [vagrant@localhost ~]$ ls /tmp [vagrant@localhost ~]$ irb irb(main):001:0> require 'socket' => true irb(main):002:0> UNIXServer.open("/tmp/socket\0ruby") {|serv| irb(main):003:1* c = UNIXSocket.open("/tmp/socket\0sapphire") irb(main):004:1> s = serv.accept irb(main):005:1> s.write "from server" irb(main):006:1> c.write "from client" irb(main):007:1> p c.recv(20) irb(main):008:1> p s.recv(20) irb(main):009:1> } "from server" "from client" => "from client" irb(main):010:0> UNIXServer.open("/tmp/socket2") {|serv| irb(main):011:1* c = Socket.unix("/tmp/socket2\0emerald") irb(main):012:1> s = serv.accept irb(main):013:1> s.write "from server" irb(main):014:1> p c.recv(20) irb(main):015:1> } "from server" => "from server" # safe irb(main):016:0> Socket.unix_server_loop("/tmp/socket3\0yellow") Traceback (most recent call last): 5: from /home/vagrant/.rbenv/versions/2.5.0/bin/irb:11:in `<main>' 4: from (irb):16 3: from /home/vagrant/.rbenv/versions/2.5.0/lib/ruby/2.5.0/socket.rb:1163:in `unix_server_loop' 2: from /home/vagrant/.rbenv/versions/2.5.0/lib/ruby/2.5.0/socket.rb:1108:in `unix_server_socket' 1: from /home/vagrant/.rbenv/versions/2.5.0/lib/ruby/2.5.0/socket.rb:1108:in `lstat' ArgumentError (path name contains null byte) irb(main):017:0> Socket.unix_server_socket("/tmp/socket3\0yellow") Traceback (most recent call last): 4: from /home/vagrant/.rbenv/versions/2.5.0/bin/irb:11:in `<main>' 3: from (irb):17 2: from /home/vagrant/.rbenv/versions/2.5.0/lib/ruby/2.5.0/socket.rb:1108:in `unix_server_socket' 1: from /home/vagrant/.rbenv/versions/2.5.0/lib/ruby/2.5.0/socket.rb:1108:in `lstat' ArgumentError (path name contains null byte) ``` ## Impact It may be connected to an unintended socket.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$500.00

Submitted

Weakness

Improper Access Control - Generic