CVE-2014-0233: Command Injection
Jeremy Choi of Red Hat reports:
Attackers, with normal user privilege, are able to do OS command injection with root by leveraging a downloadable cartridge where its source-URL scheme is 'file'.
In cartridgerepository.rb:
532 when 'file' == uri.scheme 533 entries = Dir.glob(PathUtils.join(uri.path, ''), File::FNMDO TMATCH) 534 filesystemcopy(entries, target, %w(. ..)) ... 609 Utils.oospawn("/bin/cp -ad #{entries.join(' ')} #{target}", 610 expectedexitstatus: 0)
OpenShift Origin copies the directory structure from the user specified cartridge when an application is created via 'file' scheme source. Due to this attackers are able to add an arbitrary directory with system commands (e.g. ;reboot;) in their apps and put it to cp, resulting in OS command injection attack with root privileges.
Other sources
Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0233?
CVE-2014-0233 is considered a high severity vulnerability due to its potential for OS command injection that can be exploited by normal users.
How do I fix CVE-2014-0233?
To fix CVE-2014-0233, update Red Hat OpenShift to the latest patches that address this OS command injection vulnerability.
What systems are affected by CVE-2014-0233?
CVE-2014-0233 affects Red Hat OpenShift versions 2.0 and 2.1, allowing attackers to execute commands with root privileges.
What type of attack is CVE-2014-0233?
CVE-2014-0233 is categorized as an OS command injection vulnerability due to flaws in how file URLs are processed.
Who reported the vulnerability CVE-2014-0233?
CVE-2014-0233 was reported by Jeremy Choi of Red Hat.