Title: Vulnerability Report for Ruby Gem karo-2.3.8 |
Author: Larry W. Cashdollar, @_larry0 |
Date: 2014-06-01 |
CVE-ID:[CVE-2014-10075] |
CWE: |
Download Site: http://rubygems.org/gems/karo |
Vendor: rahul.trikha[at]gmail.com |
Vendor Notified: 2014-06-25 |
Vendor Contact: rahul.trikha[at]gmail.com |
Advisory: http://www.vapid.dhs.org/advisories/karo-2.3.8.html |
Description: SSH toolbox to make running logs, sync, cache commands easier for a given rails app |
Vulnerability: From: ./karo-2.3.8/lib/karo/db.rb
Line 76 and 95 passes unsanitized user supplied input to the command line. If this gem is used in the context of a rails application malicious input could lead to remote command injection.
073- host = "{@configuration["user"]}@{@configuration["host"]}"
74- cmd = "ssh #{host} cat {server_db_config_file}"
75-
76: server_db_config_output = `{cmd}`
79-
--
89- def drop_and_create_local_database(local_db_config)
90- command = case local_db_config["adapter"]
91- when "mysql2"
93- when "postgresql"
95- dropdb -h #{local_db_config["host"]} -U #{local_db_config["username"]} --if-exists #{local_db_config["database"]} |
Export: JSON TEXT XML |
Exploit Code: |
Screen Shots: |
Notes: 108573 |
Larry W. Cashdollar
Larry Cashdollar
Larry W. Cashdollar vulnerability
Larry Cashdollar advisory