gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 40748: Fix RCE in update_social_data.pl 

This patch fixes an identified RCE in the update_social_data.pl
social_data, which when executed, allows an attacker to run arbitrary
code on the system's shell.

TO TEST:

a)  In the Babeltheque_url_update syspref, wrap any bash in $(), and then
run the update_social_data.pl script.
    *)  For example, $(whoami >
/tmp/rce.log) will output to a file the username the perl script is
running as.
APPLY PATCH
b)  Run the update_social_data.pl script again. The string is now
meta-escaped, and the RCE no longer works.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: wainuiwitikapark <wainuiwitikapark@catalyst.net.nz>
This commit is contained in:
Jake Deery 2025-09-03 15:41:14 +00:00 committed by Wainui Witika-Park
parent 8b2d721b07
commit fe969087f3
No known key found for this signature in database
GPG Key ID: 2D0A6AB5DAF1B78D
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
misc/cronjobs/social_data/update_social_data.pl
View File

@ -6,8 +6,8 @@ use Koha::Script -cron;
use C4::Context;
use C4::SocialData;
my $url = C4::Context->preference( "Babeltheque_url_update" );
my $output_dir = qq{/tmp};
my $url = quotemeta( C4::Context->preference("Babeltheque_url_update") );
my $output_dir = qq{/tmp};
my $output_filepath = qq{$output_dir/social_data.csv};
system( qq{/bin/rm -f $output_filepath} );
system( qq{/bin/rm -f $output_dir/social_data.csv.bz2} );