Bugzilla – Attachment 186924 Details for
Bug 40748
Remote-Code-Execution (RCE) in update_social_data.pl
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 40748: [24.05.x] Fix RCE in update_social_data.pl
Bug-40748-2405x-Fix-RCE-in-updatesocialdatapl.patch (text/plain), 3.68 KB, created by
Lucas Gass (lukeg)
on 2025-09-25 16:25:36 UTC
(
hide
)
Description:
Bug 40748: [24.05.x] Fix RCE in update_social_data.pl
Filename:
MIME Type:
Creator:
Lucas Gass (lukeg)
Created:
2025-09-25 16:25:36 UTC
Size:
3.68 KB
patch
obsolete
>From 4b7909221a399b218d7cc36d80ecf8fe53887ffe Mon Sep 17 00:00:00 2001 >From: Jake Deery <jake.deery@openfifth.co.uk> >Date: Wed, 3 Sep 2025 15:41:14 +0000 >Subject: [PATCH] Bug 40748: [24.05.x] Fix RCE in update_social_data.pl > >This patch fixes an identified RCE in the update_social_data.pl >social_data, which when executed, allows an attacker to run arbitrary >code on the system's shell. > >TO TEST: > >a) In the Babeltheque_url_update syspref, wrap any bash in $(), and then >run the update_social_data.pl script. > *) For example, $(whoami > >/tmp/rce.log) will output to a file the username the perl script is >running as. >APPLY PATCH >b) Run the update_social_data.pl script again. The string is now >meta-escaped, and the RCE no longer works. > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> > >Bug 40748: Check for HTTP URLs and skip shell when using system() > >This change checks for HTTP(S) URLs and skips the shell when using >system() so that shell metacharacters aren't interpreted. > >Test plan: >0. Apply the patch >1. Insert the following into the Babeltheque_url_update system preference: >$(whoami > /tmp/rce.log) >2. koha-shell kohadev >3. perl misc/cronjobs/social_data/update_social_data.pl >4. Note the script says the following: >$(whoami > /tmp/rce.log) is not a HTTP URL. Aborting. >5. Note also that /tmp/rce.log is not created >6. Change Babeltheque_url_update syspref to something like the following: >http://localhost:8080 >7. perl misc/cronjobs/social_data/update_social_data.pl >8. Note that the wget succeeds but the bunzip2 fails (as expected) since >we haven't fetched a bzipped file >9. Try to create a payload that passes the HTTP URL test with shell >metacharacters and note that they're not interpetted and instead >just used as part of a URL string. > >Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk> > >Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >--- > .../social_data/update_social_data.pl | 24 ++++++++++++------- > 1 file changed, 16 insertions(+), 8 deletions(-) > >diff --git a/misc/cronjobs/social_data/update_social_data.pl b/misc/cronjobs/social_data/update_social_data.pl >index 58e3dc06969..bee3f8090e6 100755 >--- a/misc/cronjobs/social_data/update_social_data.pl >+++ b/misc/cronjobs/social_data/update_social_data.pl >@@ -5,14 +5,22 @@ use Modern::Perl; > use Koha::Script -cron; > use C4::Context; > use C4::SocialData; >+use URI; > >-my $url = C4::Context->preference( "Babeltheque_url_update" ); >-my $output_dir = qq{/tmp}; >-my $output_filepath = qq{$output_dir/social_data.csv}; >-system( qq{/bin/rm -f $output_filepath} ); >-system( qq{/bin/rm -f $output_dir/social_data.csv.bz2} ); >-system( qq{/usr/bin/wget $url -O $output_dir/social_data.csv.bz2 } ) == 0 or die "Can't get bz2 file from url $url ($?)"; >-system( qq{/bin/bunzip2 $output_dir/social_data.csv.bz2 } ) == 0 or die "Can't extract bz2 file ($?)"; >+my $syspref_value = C4::Context->preference("Babeltheque_url_update"); >+my $url = URI->new($syspref_value); > >+#NOTE: Both HTTP and HTTPS URLs are instances of the URI::http class >+if ( $url && ref $url && $url->isa('URI::http') ) { >+ my $output_dir = qq{/tmp}; >+ my $output_filepath = qq{$output_dir/social_data.csv}; >+ system(qq{/bin/rm -f $output_filepath}); >+ system(qq{/bin/rm -f $output_dir/social_data.csv.bz2}); >+ system( '/usr/bin/wget', $url, '-O', "$output_dir/social_data.csv.bz2" ) == 0 >+ or die "Can't get bz2 file from url $url ($?)"; >+ system(qq{/bin/bunzip2 $output_dir/social_data.csv.bz2 }) == 0 or die "Can't extract bz2 file ($?)"; > >-C4::SocialData::update_data $output_filepath; >+ C4::SocialData::update_data $output_filepath; >+} else { >+ print "$syspref_value is not a HTTP URL. Aborting.\n"; >+} >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40748
:
186080
|
186082
|
186111
|
186114
|
186116
|
186117
| 186924