Ruby gem Thumbshooter 0.1.5 remote command execution

2013-03-26 / 2013-06-16

Credit: Larry W. Cashdollar

Risk: High

Local: No

Remote: Yes

CVE: CVE-2013-1898

CWE: N/A

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

Ruby gem Thumbshooter 0.1.5 remote command execution&#65279;
3/25/2013

Generates thumbshots of URLs by using Webkit and QT4.

https://github.com/digineo/thumbshooter

Specially crafted URLs can result in remote code execution if the URL contains shell metacharacters.

We see that the url is passed directly to the shell in the following code snippet from 
./thumbshooter-0.1.5/lib/thumbshooter.rb lines:

1012 command << "xvfb-run -a --server-args='-screen 0, #{screen}x24' "
1015 command << "{WEBKIT2PNG} '{url}' {args}"

1017 img = `{command} 2>&1`

Larry W. Cashdollar
@_larry0
http://vapid.dhs.org/advisories/thumbshooter-ruby-gem-remoteexec.html

References:

http://vapid.dhs.org/advisories/thumbshooter-ruby-gem-remoteexec.html

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Ruby gem Thumbshooter 0.1.5 remote command execution

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.