From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs Subject: bug#59817: [PATCH] Fix etags local command injection vulnerability Date: Sun, 04 Dec 2022 16:39:10 +0200 Message-ID: <83r0xf9qsx.fsf@gnu.org> References: Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="35046"; mail-complaints-to="usenet@ciao.gmane.io" Cc: 59817@debbugs.gnu.org To: lux Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Sun Dec 04 15:40:29 2022 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1p1qAO-0008w5-Ag for geb-bug-gnu-emacs@m.gmane-mx.org; Sun, 04 Dec 2022 15:40:28 +0100 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1p1qA0-0003V2-00; Sun, 04 Dec 2022 09:40:04 -0500 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p1q9y-0003Ul-U8 for bug-gnu-emacs@gnu.org; Sun, 04 Dec 2022 09:40:02 -0500 Original-Received: from debbugs.gnu.org ([209.51.188.43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1p1q9y-0005j7-EN for bug-gnu-emacs@gnu.org; Sun, 04 Dec 2022 09:40:02 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1p1q9y-0000Qf-A5 for bug-gnu-emacs@gnu.org; Sun, 04 Dec 2022 09:40:02 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Eli Zaretskii Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sun, 04 Dec 2022 14:40:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 59817 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch Original-Received: via spool by 59817-submit@debbugs.gnu.org id=B59817.16701647791637 (code B ref 59817); Sun, 04 Dec 2022 14:40:02 +0000 Original-Received: (at 59817) by debbugs.gnu.org; 4 Dec 2022 14:39:39 +0000 Original-Received: from localhost ([127.0.0.1]:58052 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1p1q9a-0000QL-RM for submit@debbugs.gnu.org; Sun, 04 Dec 2022 09:39:39 -0500 Original-Received: from eggs.gnu.org ([209.51.188.92]:48484) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1p1q9Z-0000QE-9O for 59817@debbugs.gnu.org; Sun, 04 Dec 2022 09:39:37 -0500 Original-Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p1q9S-00053Z-Vj; Sun, 04 Dec 2022 09:39:30 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=References:Subject:In-Reply-To:To:From:Date: mime-version; bh=LkaxDOR2sEP3yuMAEC0+1WXGDStWzsL0+fyDqeX1mUw=; b=W/xz8HVhSLIH eychm2G12qG3r5nTSp9B9VjSIWX5DwZarpFgbjs4rb2dzOTgw6k7b+bWTEc1lwvLIh8mD0lRlljga 2GA5DNaKteACd2S9aBsc6E6NIL3a5mHEc00GBhIdKyt3SnVAL7dM0wQb5Zr7GVlz698oQJ2kPd++F SYfl96nsYL6TEm9KeDm5l3LK7ObCumEX0hvX61eIJHc+oso8jMTIbK16w3vSuNdNQSx82XeVtg6J4 bzizfnGrc7IYaa1BvBlMls33eBuUQCG2zdKSwVsVZh0w1mH88k8oMZ7J91MmcjrCEbc/GlV7JygId zJv7IKBygBf+opvFyBKtDw==; Original-Received: from [87.69.77.57] (helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1p1q9S-0005th-8q; Sun, 04 Dec 2022 09:39:30 -0500 In-Reply-To: (message from lux on Sun, 4 Dec 2022 21:51:13 +0800) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.bugs:249948 Archived-At: > Date: Sun, 4 Dec 2022 21:51:13 +0800 > From: lux > > Hi, this patch fix a new local command injection vulnerability in the > etags.c. > > This vulnerability occurs in the following code: > > #if MSDOS || defined (DOS_NT) > char *cmd1 = concat (compr->command, " \"", real_name); > char *cmd = concat (cmd1, "\" > ", tmp_name); > #else > char *cmd1 = concat (compr->command, " '", real_name); > char *cmd = concat (cmd1, "' > ", tmp_name); > #endif > free (cmd1); > inf = (system (cmd) == -1 > ? NULL > : fopen (tmp_name, "r" FOPEN_BINARY)); > free (cmd); > } > > Vulnerability #1: > > for tmp_name variable, the value from the etags_mktmp() function, this > function takes the value from the environment variable `TMPDIR`, `TEMP` > or `TMP`, but without checking the value. So, if then hacker can > control these environment variables, can execute the shell code. > > Attack example: > > $ ls > etags.c > $ zip etags.z etags.c > adding: etags.c (deflated 72%) > $ tmpdir="/tmp/;uname -a;/" > $ mkdir $tmpdir > $ TMPDIR=$tmpdir etags * > sh: line 1: /tmp/: Is a directory > Linux mypc 6.0.10-300.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Nov 26 > 16:55:13 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux sh: line 1: /etECggCJ: > No such file or directory etags: skipping inclusion of TAGS in self. > > Vulnerability #2: > > If the target file is a compressed file, execute system commands (such > as gzip, etc.), but do not check the file name. > > Attack example: > > $ ls > etags.c > $ zip "';uname -a;'test.z" etags.c <--- inject the shell code to > filename > adding: etags.c (deflated 72%) > $ etags * > gzip: .gz: No such file or directory > Linux mypc 6.0.10-300.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Nov 26 > 16:55:13 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux sh: line 1: test.z: > command not found > > I fix this vulnerability. By create a process, instead of call the > sh or cmd.exe, and this patch work the Linux, BSD and Windows. Thanks, but no, thanks. This cure is worse than the disease. Let's please find simpler, more robust solutions. It TMPDIR is a problem, let's use a file whose name is hard-coded in the etags.c source, or quote the name when we pass it to the shell. If we suspect someone could disguise shell commands as file names, let's quote the file names we pass to the shell with '...' to prevent that. Etc. etc. -- let's use simple solutions that don't drastically change the code. Please understand: etags is a stable program. I'm not interested in changes that modify its design or implementation in such drastic ways.