Red Hat Bugzilla – Bug 989670
CVE-2013-1436 XMonad.Hooks.DynamicLog remote command injection flaw
Last modified: 2013-08-08 17:24:32 EDT
It was reported  that XMonad's contributed DynamicLog module was vulnerable to a remote command injection flaw. From the report:
DynamicLog module feeds information to others programs about what's
happening on xmonad window manager. Such programs generally are status bars
as xmobar or dzen2. These programs features the ability of receiving
formatted input from stdin, and that's the way used by xmonad to
communicate information such as workspace status, current layout and window
title. So far, so good.
Both bars uses some meta-language to format their input. For example,
xmobar will make the following text clickable.
<action=xclock>Click to clock</action>
Vulnerability & exploit
As we know, web browsers usually set the window title to the current tab. A
malicious user, then, can craft a special title in order to inject commands
in the current bar. In xmobar this will be something like this:
<title><action=xclock>An innocent title</action></title>
<h1>Good bye, cruel world</h1>
So, if the user accidentally (or incidentally) clicks on the xmobar window
title, the command will be executed. In dzen2 this is also possible,
although I haven't tried to execute code. A (harmless) proof of concept is
attached for both bars. The proof for dzen2 just changes the background
color of the bar.
This has been corrected in upstream version 0.11.2 and a patch is available .
Created ghc-xmonad-contrib tracking bugs for this issue:
Affects: fedora-all [bug 989671]
Affects: epel-6 [bug 989673]
This issue is CVE-2013-1436 and not CVE-2013-1435.
Oops, it is indeed. Sorry about that.
ghc-xmonad-contrib-0.11-1.1.fc18, bluetile-0.6-13.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
ghc-xmonad-contrib-0.11.2-1.fc19, ghc-X11-18.104.22.168-1.fc19, xmonad-0.11-4.fc19, ghc-X11-xft-0.3.1-10.fc19, bluetile-0.6-18.fc19, xmobar-0.18-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.