From ba2e853667a1eb52072b45ba42a3cfd64e221288 Mon Sep 17 00:00:00 2001 From: Jake Deery Date: Wed, 3 Sep 2025 15:41:14 +0000 Subject: [PATCH] Bug 40748: Fix RCE in update_social_data.pl This patch fixes an identified RCE in the update_social_data.pl social_data, which when executed, allows an attacker to run arbitrary code on the system's shell. TO TEST: a) In the Babeltheque_url_update syspref, wrap any bash in $(), and then run the update_social_data.pl script. *) For example, $(whoami > /tmp/rce.log) will output to a file the username the perl script is running as. APPLY PATCH b) Run the update_social_data.pl script again. The string is now meta-escaped, and the RCE no longer works. --- misc/cronjobs/social_data/update_social_data.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/misc/cronjobs/social_data/update_social_data.pl b/misc/cronjobs/social_data/update_social_data.pl index e0de0aa1ce8..dff5a1c4856 100755 --- a/misc/cronjobs/social_data/update_social_data.pl +++ b/misc/cronjobs/social_data/update_social_data.pl @@ -6,7 +6,7 @@ use Koha::Script -cron; use C4::Context; use C4::SocialData; -my $url = C4::Context->preference("Babeltheque_url_update"); +my $url = quotemeta( C4::Context->preference("Babeltheque_url_update") ); my $output_dir = qq{/tmp}; my $output_filepath = qq{$output_dir/social_data.csv}; system(qq{/bin/rm -f $output_filepath}); -- 2.43.0