REDHAT-BUG-1096955: Command Injection
Jeremy Choi of Red Hat reports:
Attackers, with normal user privilege, are able to do OS command injection with root by leveraging a downloadable cartridge where its source-URL scheme is 'file'.
In cartridgerepository.rb:
532 when 'file' == uri.scheme 533 entries = Dir.glob(PathUtils.join(uri.path, ''), File::FNMDO TMATCH) 534 filesystemcopy(entries, target, %w(. ..)) ... 609 Utils.oospawn("/bin/cp -ad #{entries.join(' ')} #{target}", 610 expectedexitstatus: 0)
OpenShift Origin copies the directory structure from the user specified cartridge when an application is created via 'file' scheme source. Due to this attackers are able to add an arbitrary directory with system commands (e.g. ;reboot;) in their apps and put it to cp, resulting in OS command injection attack with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1096955?
REDHAT-BUG-1096955 is considered a high severity vulnerability due to the potential for OS command injection with root privileges.
How do I fix REDHAT-BUG-1096955?
To fix REDHAT-BUG-1096955, update your Red Hat OpenShift Origin to the latest patched version that addresses this vulnerability.
What type of attack is involved in REDHAT-BUG-1096955?
REDHAT-BUG-1096955 involves an OS command injection attack that can be exploited by normal users with the ability to leverage a downloadable cartridge.
Who reported REDHAT-BUG-1096955?
REDHAT-BUG-1096955 was reported by Jeremy Choi of Red Hat.
What products are affected by REDHAT-BUG-1096955?
The vulnerability REDHAT-BUG-1096955 affects Red Hat OpenShift Origin software.