Larry Cashdollar Vulnerability

Advisory #: 52

Title: Flash Tool 0.6.0 Remote code execution vulnerability

Author: Larry W. Cashdollar, @_larry0

Date: 2013-03-01

CVE-ID:[CVE-2013-2513]

CWE:

Download Site: http://rubygems.org/gems/flash_tool

Vendor: Bojan Milosavljevic

Vendor Notified: 2013-03-04

Vendor Contact: milboj@gmail.com

Advisory: http://www.vapid.dhs.org/advisories/flash_tool-0.6.0-cmd_exec.html

Description: A ruby wrapper for swftool command line tool. http://www.swftools.org/ Flash tool is small and mini tool for creating swf files from pdfs, pictures and fonts and parsing data from flash files.

Vulnerability:

If files downloaded contain shell characters it's possible to execute code as the client user. ie: flash_file;id>/tmp/o;.swf ./flash_tool-0.6.0/lib/flash_tool.rb Lines: 26 command = "swfstrings #{file}" 27: output = `#{command} 2>&1` 88: command = "#{command} #{option} #{file}" 89: output = `#{command} 2>&1` ./flash_tool-0.6.0/lib/flash_tool/flash.rb 75: command = "#{command} #{args.join(" ")}" 76: output = `#{command} 2>&1`

Export: JSON TEXT XML

Exploit Code:

Screen Shots:

Notes: