Repository navigation
CVE-2017-17514: shell argument injection via crafted URL #70
Description
Hi John, CVE-2017-17514 showed up today:
boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Except for the Debian security tracker page, I can find no information about it, so I'm guessing you weren't informed either. 8.4.0 is apparently the last version packaged by Debian, but later nip2 releases also carry the same code.
In case it's useful, there's a form for submitting updates or corrections to CVE records.
Activity
jcupitt commentedon Dec 15, 2017
Hi Benjamin, thanks for letting me know!
My guess is that this is a false positive from an automated search for
BROWSER. In nip2,BROWSER(I keep typing "bowser" by mistake and having to correct it) is not an env var, it's the name of a row in the preferences workspace.The reference to
BOX_BROWSERin boxes.c:https://github.com/jcupitt/nip2/blob/master/src/boxes.c#L727
Fetches
BROWSERfrom preferences:https://github.com/jcupitt/nip2/blob/master/src/watch.h#L300
In prefs,
BROWSERis equal toL2.value:https://github.com/jcupitt/nip2/blob/master/share/nip2/start/Preferences.ws#L381
And
L2is just"firefox":https://github.com/jcupitt/nip2/blob/master/share/nip2/start/Preferences.ws#L740
I'll try submitting a correction, with this issue as evidence.
jcupitt commentedon Dec 15, 2017
OK, I've asked for the issue to be closed, request number 434637. I'll update if I hear back.
Thanks again!
bgilbert commentedon Dec 15, 2017
Hi John, where does the URL argument come from? Is it possible that a malicious workspace could embed a URL with a semicolon and a shell command?
jcupitt commentedon Dec 15, 2017
helpindex.hlinks help tags in the source to references to pages in the manual, it can't be changed by the workspace.The preferences are kept as a workspace, but it's a special one that nip2 loads directly.
jcupitt commentedon Dec 15, 2017
It's true that if an attacker could modify the prefs file (the user's personal one is kept in
~/.nip2-x.y.x/start/Preferences.ws), then they could make nip2 execute some arbitrary code the next time the user pressed F1.Does that count as a vulnerability? If they can modify that file, they can modify
~/.profileas well, which would be just as serious.bgilbert commentedon Dec 16, 2017
I don't think an attack that requires the attacker to modify the prefs file is a meaningful vulnerability, provided that there's no way for a workspace to do that autonomously.
I see the CVE entry is now marked DISPUTED.