Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Remote command execution in Ruby Gem Command Wrap
From: larry Cashdollar <larry0 () me com>
Date: Mon, 18 Mar 2013 18:56:42 -0400

Remote command execution in Ruby Gem Command Wrap


Commands executed if the remote URL or filename contains the shell character ';'. The commands will be executed as the 
client user if tricked into using the malicious URL or filename.

Examining the following lines:

command_wrap.rb-7- def self.capture (url, target)

command_wrap.rb-8- command = CommandWrap::Config::Xvfb.command(File.dirname(__FILE__) + "/../bin/CutyCapt 
--min-width=1024 --min-height=768 --url={url} --out={target}") command_wrap.rb:9: `#{command}`
command_wrap.rb-10- end
command_wrap.rb-72- command = CommandWrap::Config::Xvfb.command(File.dirname(__FILE__) + "/../bin/wkhtmltopdf --quiet 
--print-media-type #{source} #{params} #{target}") command_wrap.rb-73-
command_wrap.rb:74: `#{command}`

Untrusted data is passed to the command line.

Larry W. Cashdollar
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Remote command execution in Ruby Gem Command Wrap larry Cashdollar (Mar 18)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]