gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 40748: [24.05.x] Fix RCE in update_social_data.pl 

This patch fixes an identified RCE in the update_social_data.pl
social_data, which when executed, allows an attacker to run arbitrary
code on the system's shell.

TO TEST:

a)  In the Babeltheque_url_update syspref, wrap any bash in $(), and then
run the update_social_data.pl script.
    *)  For example, $(whoami >
/tmp/rce.log) will output to a file the username the perl script is
running as.
APPLY PATCH
b)  Run the update_social_data.pl script again. The string is now
meta-escaped, and the RCE no longer works.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Bug 40748: Check for HTTP URLs and skip shell when using system()

This change checks for HTTP(S) URLs and skips the shell when using
system() so that shell metacharacters aren't interpreted.

Test plan:
0. Apply the patch
1. Insert the following into the Babeltheque_url_update system preference:
$(whoami > /tmp/rce.log)
2. koha-shell kohadev
3. perl misc/cronjobs/social_data/update_social_data.pl
4. Note the script says the following:
$(whoami > /tmp/rce.log) is not a HTTP URL. Aborting.
5. Note also that /tmp/rce.log is not created
6. Change Babeltheque_url_update syspref to something like the following:
http://localhost:8080
7. perl misc/cronjobs/social_data/update_social_data.pl
8. Note that the wget succeeds but the bunzip2 fails (as expected) since
we haven't fetched a bzipped file
9. Try to create a payload that passes the HTTP URL test with shell
metacharacters and note that they're not interpetted and instead
just used as part of a URL string.

Signed-off-by: Jake Deery <jake.deery@openfifth.co.uk>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
This commit is contained in:
Jake Deery 2025-09-03 15:41:14 +00:00 committed by Paul Derscheid
parent 193efe1142
commit 78b0a04d6a
No known key found for this signature in database
GPG Key ID: C25F9FD44CED595B
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
misc/cronjobs/social_data/update_social_data.pl
View File

@ -5,14 +5,22 @@ use Modern::Perl;
use Koha::Script -cron;
use C4::Context;
use C4::SocialData;
use URI;
my $url = C4::Context->preference( "Babeltheque_url_update" );
my $output_dir = qq{/tmp};
my $output_filepath = qq{$output_dir/social_data.csv};
system( qq{/bin/rm -f $output_filepath} );
system( qq{/bin/rm -f $output_dir/social_data.csv.bz2} );
system( qq{/usr/bin/wget $url -O $output_dir/social_data.csv.bz2 } ) == 0 or die "Can't get bz2 file from url $url ($?)";
system( qq{/bin/bunzip2 $output_dir/social_data.csv.bz2 } ) == 0 or die "Can't extract bz2 file ($?)";
my $syspref_value = C4::Context->preference("Babeltheque_url_update");
my $url = URI->new($syspref_value);
#NOTE: Both HTTP and HTTPS URLs are instances of the URI::http class
if ( $url && ref $url && $url->isa('URI::http') ) {
my $output_dir = qq{/tmp};
my $output_filepath = qq{$output_dir/social_data.csv};
system(qq{/bin/rm -f $output_filepath});
system(qq{/bin/rm -f $output_dir/social_data.csv.bz2});
system( '/usr/bin/wget', $url, '-O', "$output_dir/social_data.csv.bz2" ) == 0
or die "Can't get bz2 file from url $url ($?)";
system(qq{/bin/bunzip2 $output_dir/social_data.csv.bz2 }) == 0 or die "Can't extract bz2 file ($?)";
C4::SocialData::update_data $output_filepath;
C4::SocialData::update_data $output_filepath;
} else {
print "$syspref_value is not a HTTP URL. Aborting.\n";
}