Ruby gem Thumbshooter 0.1.5 remote command execution

2013-03-26 / 2013-06-16

Credit: Larry W. Cashdollar

Risk: High

Local: No

Remote: Yes

CVE: CVE-2013-1898

CWE: N/A

Ogólna skala CVSS: 7.5/10

Znaczenie: 6.4/10

Łatwość wykorzystania: 10/10

Wymagany dostęp: Zdalny

Złożoność ataku: Niska

Autoryzacja: Nie wymagana

Wpływ na poufność: Częściowy

Wpływ na integralność: Częściowy

Wpływ na dostępność: Częściowy

Ruby gem Thumbshooter 0.1.5 remote command execution&#65279;
3/25/2013

Generates thumbshots of URLs by using Webkit and QT4.

https://github.com/digineo/thumbshooter

Specially crafted URLs can result in remote code execution if the URL contains shell metacharacters.

We see that the url is passed directly to the shell in the following code snippet from 
./thumbshooter-0.1.5/lib/thumbshooter.rb lines:

1012 command << "xvfb-run -a --server-args='-screen 0, #{screen}x24' "
1015 command << "{WEBKIT2PNG} '{url}' {args}"

1017 img = `{command} 2>&1`

Larry W. Cashdollar
@_larry0
http://vapid.dhs.org/advisories/thumbshooter-ruby-gem-remoteexec.html

Referencje:

http://vapid.dhs.org/advisories/thumbshooter-ruby-gem-remoteexec.html

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Ruby gem Thumbshooter 0.1.5 remote command execution

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.