Bug 960363 (CVE-2013-2060)

Summary: CVE-2013-2060 OpenShift: Potential remote command execution vulnerability in download cart url
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bleanhar, ccoleman, dmcphers, jialiu, lmeyer, rcvalle, tkramer
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-05-07 18:24:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 958928    
Bug Blocks:    

Description Kurt Seifried 2013-05-07 06:06:30 UTC
Clayton Coleman reports:

Never use the ` form in ruby when the variables aren't known to be safe values

  def self.download_from_url(url)
    max_dl_time = (Rails.application.config.downloaded_cartridges[:max_download_time] rescue 10) || 10
    max_file_size = (Rails.application.config.downloaded_cartridges[:max_cart_size] rescue 20480) || 20480
    max_redirs = (Rails.application.config.downloaded_cartridges[:max_download_redirects] rescue 2) || 2
    `curl --max-time #{max_dl_time} --connect-timeout 2 --location --max-redirs #{max_redirs} --max-filesize #{max_file_size} -k #{url}`
  end

If 'URL' is not properly validated, then someone could inject " ; rm -rf /*"

In this method, URL needs to be a properly formatted URI with a known whitelist of parameters.

In addition, we should only accept URI's that are of the following whitelisted criteria:

Parses URI successfully
Protocol is 'http', 'https', 'git', 'ftp' (I can't think of others that are really safe).  'file' should NOT be allowed
Host must be specified, and be non localhost (otherwise you allow a local injection attack).  We need to be very careful here not to allow probing of the internal network, so we should only allow addresses that resolve outside of the exsrvs.  
Port should be valid
Path should be valid

If the URI does not meet these criteria an error message should be returned to the user.