Bug #14205: Unsanitizied filename leads to command injection in 'resolv.rb'

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 2.3: UNKNOWN, 2.4: UNKNOWN

[drigg3r (Jasraj Bedi)]

Here is the pull request
https://github.com/ruby/ruby/pull/1777

[drigg3r (Jasraj Bedi)]

• Subject changed from Unsanitizied filename leads to command injection in 'resolv' to Unsanitizied filename leads to command injection in 'resolv.rb'

PoC Concept Code

require 'resolv'
a = Resolv::Hosts::new("|echo 1 > /tmp/rce")
a.getaddress("test")

[nobu (Nobuyoshi Nakada)]

• Status changed from Open to Closed

Applied in changeset trunk|r61349.

---

Fixed command Injection

• resolv.rb (Resolv::Hosts#lazy_initialize): fixed potential
  command Injection in Hosts::new() by use of Kernel#open.
  [Fix GH-1777] [ruby-core:84347] [Bug #14205]

From: Drigg3r [e-mail]