Bug 968166 (CVE-2013-2121)

Ramon de C Valle (rcvalle@redhat.com) reports:

There is a code injection vulnerability in the create method of the
Bookmarks controller. The create method uses the (mass-assigned)
controller attribute of the newly created bookmark in an eval statement
without sanitizing it:

def create
@bookmark = Bookmark.new(params[:bookmark])

respond_to do |format|
if @bookmark.save
format.html { redirect_to(eval(@bookmark.controller+"_path"),
:notice => _('Bookmark was successfully created.')) }
else
format.html { render :action => "new" }
end
end
end

Any user with permissions to create a bookmark can execute arbitrary
code and arbitrary system commands by sending a specially-crafted POST
request. The controller attribute is validated with the regular
expression /\A(\S+)\Z/, which prevents us from using code containing
spaces. However, this can be easily circumvented (see example (a)). The
following are some possible example attacks, including arbitrary command
execution.