CVE-2013-2121: Code Injection

Ramon de C Valle (rcvalle) reports:

There is a code injection vulnerability in the create method of the Bookmarks controller. The create method uses the (mass-assigned) controller attribute of the newly created bookmark in an eval statement without sanitizing it:

def create @bookmark = Bookmark.new(params[:bookmark])

respondto do |format| if @bookmark.save format.html { redirectto(eval(@bookmark.controller+"path"), :notice => ('Bookmark was successfully created.')) } else format.html { render :action => "new" } end end end

Any user with permissions to create a bookmark can execute arbitrary code and arbitrary system commands by sending a specially-crafted POST request. The controller attribute is validated with the regular expression /\A(\S+)\Z/, which prevents us from using code containing spaces. However, this can be easily circumvented (see example (a)). The following are some possible example attacks, including arbitrary command execution.

— Red Hat