[ruby-core:63839] [ruby-trunk - Bug #10066] [Open] File.expand_path performs poor validation of absolute path

From: peter@...
Date: 2014-07-18 22:02:29 UTC
List: ruby-core #63839
Issue #10066 has been reported by Peter Blay.

----------------------------------------
Bug #10066: File.expand_path performs poor validation of absolute path
https://bugs.ruby-lang.org/issues/10066

* Author: Peter Blay
* Status: Open
* Priority: Normal
* Assignee: 
* Category: 
* Target version: 
* ruby -v: ruby 2.2.0dev (2014-07-19 trunk 46871) [x86_64-linux]
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN
----------------------------------------
With File.expand_path(), if one of the arguments is of the form "~/.*", then it will search for the environment variable $HOME. If this is set to: 

export HOME="/home/peter"

Then searching for File.expand_path '~/.bashrc' works as expected. If the variable is specified as: 

export HOME="ls -la / #"
Then File.expand_path '~/.bashrc' works as expected and raises an ArgumentError for a non-absolute home. However this performs a poor validation on the environment variable, as this works around the issue: 

export HOME="/bin/bash -c \"ls -la /\" #/home/peter"

From here File.expand_path '~/.bashrc' returns: 

"/bin/bash -c \"ls -la /\" #/home/peter/.bashrc"

This potentially enables various security vulnerabilities such as command injection above, if this is passed to a function that runs commands, or could potentially allow an attacker other means of attack on privilege escalation, or to change other values within an application. 
Please note that this affects both arguments for File.expand_path()



-- 
https://bugs.ruby-lang.org/

In This Thread

Prev Next