CVE-2014-3496: Code Injection

Jeremy Choi of Red Hat reports:

OpenShift Origin does not properly validated 'Source-Url' of cartridge manifest files to create applications and so commands injected like below in it will be executed in the node.

Source-Url: http://name-app.example.com/test/test;reboot;.tar.gz

Attacks can also succeed when the source-URL ends with .zip, .tgz and .tar. The file specified in Source-Url must be available from the URL for the successful attack.

In cartridgerepository.rb:

498 temporary = PathUtils.join(File.dirname(target), File.basename(cartridge.sourceurl)) (deleted for brevity) 519 when uri.scheme =~ /^https/ && cartridge.sourceurl =~ /(\.tar\.gz|\.tgz)$/ 520 begin 521 uricopy(URI(cartridge.sourceurl), temporary, cartridge.sourcemd5) 522 extract(:tgz, temporary, target) 523 ensure 524 FileUtils.rm(temporary) 525 end (deleted for brevity) 617 def self.extract(method, source, target) 618 case method 622 when :tgz 623 Utils.oospawn("/bin/tar -C #{target} -zxpf #{source}", 624 expectedexitstatus: 0)

The system command execution in line 623 will run #{source} which is comprised of cartridge.sourceurl. While the source url is validated in manifest.rb, still ';' can be injected.

370 if @manifest.haskey?('Source-Url') 371 raise InvalidElementError.new('Source-Url') unless @manifest['Source-Url'] =~ URI::ABSURI 372 @sourceurl = @manifest['Source-Url']

The PoC below has been shown in Online devenv4873

1. Create a devenv. 2. Place a malformed manifest file with Source-Url modified in a host the devenv can access. Source-Url: http://<host>/test;reboot;.tar.gz

3. Create "test;reboot;.tar.gz" at the path of Source-Url in the host. 4. Try to create a cartridge with the malformed manifest. $ rhc app create app1 http://<host>/manifest.yml --no-git

The devenv will reboot.

— Red Hat