Title: Command injection vulnerability in Ruby Gem sprout 0.7.246
Date: 11/14/2013
Download: http://rubygems.org/gems/sprout, http://projectsprouts.org/
Vulnerability:
The unpack_zip() function contains the following code:
sprout-0.7.246/lib/sprout/archive_unpacker.rb
60 zip_dir = File.expand_path(File.dirname(zip_file))
61 zip_name = File.basename(zip_file)
62 output = File.expand_path(dir)
63 # puts ">> zip_dir: #{zip_dir} zip_name: #{zip_name} output: #{output} "
64 %x(cd #{zip_dir};unzip #{zip_name} -d #{output})
If the attacker can control zip_dir, zip_name or output then they can possibly
execute shell commands by injecting shell meta characters as input.
PoC:
For example: filename;id;.zip
I contacted the developer a few weeks ago but received no response.
Thanks!
Larry W. Cashdollar
@_larry0
http://vapid.dhs.org/advisories/
{"id": "SECURITYVULNS:DOC:30159", "bulletinFamily": "software", "title": "Command injection vulnerability in Ruby Gem sprout 0.7.246", "description": "\r\n\r\nTitle: Command injection vulnerability in Ruby Gem sprout 0.7.246\r\n\r\nDate: 11/14/2013\r\n\r\nDownload: http://rubygems.org/gems/sprout, http://projectsprouts.org/\r\n\r\nVulnerability:\r\n\r\nThe unpack_zip() function contains the following code:\r\n\r\nsprout-0.7.246/lib/sprout/archive_unpacker.rb\r\n\r\n60 zip_dir = File.expand_path(File.dirname(zip_file))\r\n61 zip_name = File.basename(zip_file)\r\n62 output = File.expand_path(dir)\r\n63 # puts ">> zip_dir: #{zip_dir} zip_name: #{zip_name} output: #{output} " \r\n64 %x(cd #{zip_dir};unzip #{zip_name} -d #{output})\r\n\r\n\r\nIf the attacker can control zip_dir, zip_name or output then they can possibly \r\nexecute shell commands by injecting shell meta characters as input. \r\n\r\n\r\nPoC:\r\n\r\nFor example: filename;id;.zip\r\n\r\nI contacted the developer a few weeks ago but received no response.\r\n\r\n\r\nThanks!\r\nLarry W. Cashdollar\r\n@_larry0\r\nhttp://vapid.dhs.org/advisories/\r\n", "published": "2014-01-08T00:00:00", "modified": "2014-01-08T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30159", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:50", "edition": 1, "viewCount": 14, "enchantments": {"score": {"value": 1.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13481"]}], "rev": 4}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13481"]}]}, "exploitation": null, "vulnersScore": 1.5}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645588597}}
Command injection vulnerability in Ruby Gem sprout 0.7.246