CVE-2013-2060: OS Command Injection

First published: Tue May 07 2013(Updated: )

Clayton Coleman reports: Never use the ` form in ruby when the variables aren't known to be safe values def self.download_from_url(url) max_dl_time = (Rails.application.config.downloaded_cartridges[:max_download_time] rescue 10) || 10 max_file_size = (Rails.application.config.downloaded_cartridges[:max_cart_size] rescue 20480) || 20480 max_redirs = (Rails.application.config.downloaded_cartridges[:max_download_redirects] rescue 2) || 2 `curl --max-time #{max_dl_time} --connect-timeout 2 --location --max-redirs #{max_redirs} --max-filesize #{max_file_size} -k #{url}` end If 'URL' is not properly validated, then someone could inject " ; rm -rf /*" In this method, URL needs to be a properly formatted URI with a known whitelist of parameters. In addition, we should only accept URI's that are of the following whitelisted criteria: Parses URI successfully Protocol is 'http', 'https', 'git', 'ftp' (I can't think of others that are really safe). 'file' should NOT be allowed Host must be specified, and be non localhost (otherwise you allow a local injection attack). We need to be very careful here not to allow probing of the internal network, so we should only allow addresses that resolve outside of the exsrvs. Port should be valid Path should be valid If the URI does not meet these criteria an error message should be returned to the user.

Credit: secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/references
• agent/type
• collector/nvd-index
• agent/software-canonical-lookup-request
• agent/weakness
• agent/author
• agent/softwarecombine
• collector/mitre-cve
• source/MITRE
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2013-2060
• agent/last-modified-date
• agent/severity
• agent/tags
• agent/description
• agent/first-publish-date
• agent/event
• agent/trending
• vendor/redhat
• canonical/redhat openshift
• version/redhat openshift/1.0