Bugzilla – Attachment 186114 Details for
Bug 40748
Remote-Code-Execution (RCE) in update_social_data.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 40748: Check for HTTP URLs and skip shell when using system()
Bug-40748-Check-for-HTTP-URLs-and-skip-shell-when-.patch (text/plain), 3.00 KB, created by
Jake Deery
on 2025-09-04 08:10:53 UTC
(
hide
)
Description:
Bug 40748: Check for HTTP URLs and skip shell when using system()
Filename:
MIME Type:
Creator:
Jake Deery
Created:
2025-09-04 08:10:53 UTC
Size:
3.00 KB
patch
obsolete
>From e930b0ab0cebce811c1678ff2b1298a9ba9640b0 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Thu, 4 Sep 2025 01:20:38 +0000 >Subject: [PATCH] Bug 40748: Check for HTTP URLs and skip shell when using > system() > >This change checks for HTTP(S) URLs and skips the shell when using >system() so that shell metacharacters aren't interpreted. > >Test plan: >0. Apply the patch >1. Insert the following into the Babeltheque_url_update system preference: >$(whoami > /tmp/rce.log) >2. koha-shell kohadev >3. perl misc/cronjobs/social_data/update_social_data.pl >4. Note the script says the following: >$(whoami > /tmp/rce.log) is not a HTTP URL. Aborting. >5. Note also that /tmp/rce.log is not created >6. Change Babeltheque_url_update syspref to something like the following: >http://localhost:8080 >7. perl misc/cronjobs/social_data/update_social_data.pl >8. Note that the wget succeeds but the bunzip2 fails (as expected) since >we haven't fetched a bzipped file >9. Try to create a payload that passes the HTTP URL test with shell >metacharacters and note that they're not interpetted and instead >just used as part of a URL string. > >Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk> >--- > .../social_data/update_social_data.pl | 25 +++++++++++++------ > 1 file changed, 17 insertions(+), 8 deletions(-) > >diff --git a/misc/cronjobs/social_data/update_social_data.pl b/misc/cronjobs/social_data/update_social_data.pl >index dff5a1c4856..bee3f8090e6 100755 >--- a/misc/cronjobs/social_data/update_social_data.pl >+++ b/misc/cronjobs/social_data/update_social_data.pl >@@ -5,13 +5,22 @@ use Modern::Perl; > use Koha::Script -cron; > use C4::Context; > use C4::SocialData; >+use URI; > >-my $url = quotemeta( C4::Context->preference("Babeltheque_url_update") ); >-my $output_dir = qq{/tmp}; >-my $output_filepath = qq{$output_dir/social_data.csv}; >-system(qq{/bin/rm -f $output_filepath}); >-system(qq{/bin/rm -f $output_dir/social_data.csv.bz2}); >-system(qq{/usr/bin/wget $url -O $output_dir/social_data.csv.bz2 }) == 0 or die "Can't get bz2 file from url $url ($?)"; >-system(qq{/bin/bunzip2 $output_dir/social_data.csv.bz2 }) == 0 or die "Can't extract bz2 file ($?)"; >+my $syspref_value = C4::Context->preference("Babeltheque_url_update"); >+my $url = URI->new($syspref_value); > >-C4::SocialData::update_data $output_filepath; >+#NOTE: Both HTTP and HTTPS URLs are instances of the URI::http class >+if ( $url && ref $url && $url->isa('URI::http') ) { >+ my $output_dir = qq{/tmp}; >+ my $output_filepath = qq{$output_dir/social_data.csv}; >+ system(qq{/bin/rm -f $output_filepath}); >+ system(qq{/bin/rm -f $output_dir/social_data.csv.bz2}); >+ system( '/usr/bin/wget', $url, '-O', "$output_dir/social_data.csv.bz2" ) == 0 >+ or die "Can't get bz2 file from url $url ($?)"; >+ system(qq{/bin/bunzip2 $output_dir/social_data.csv.bz2 }) == 0 or die "Can't extract bz2 file ($?)"; >+ >+ C4::SocialData::update_data $output_filepath; >+} else { >+ print "$syspref_value is not a HTTP URL. Aborting.\n"; >+} >-- >2.43.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40748
:
186080
|
186082
|
186111
|
186114
|
186116
|
186117
|
186924