Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Shell Injection in Pygments FontManager._get_nix_font_path
- Product: Pygments
- Version: 1.2.2-2.0.2 497:fe62167596bb to 3693:655dbebddc23 Tue Nov 06 17:30:45 2007 +0000 to Aug 21, 2015.
- Website: http://pygments.org/
- Bitbucket: https://bitbucket.org/birkenfeld/pygments-main
- CVSS Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
- Discovery: Aug 21, 2015
- An unsafe use of string concatenation in a shell string occurs in FontManager. If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system. The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options.
- pygments/formatters/img.py:82
- def _get_nix_font_path(self, name, style):
- try:
- from commands import getstatusoutput
- except ImportError:
- from subprocess import getstatusoutput
- exit, out = getstatusoutput('fc-list "%s:style=%s" file' %
- (name, style))
- if not exit:
- lines = out.splitlines()
- if lines:
- path = lines[0].strip().strip(':')
- return path
- https://bitbucket.org/birkenfeld/pygments-main/src/655dbebddc23943b8047b3c139c51c22ef18fd91/pygments/formatters/img.py?at=default&fileviewer=file-view-default#img.py-82
- Recommendation
- shlex.quote should be used to ensure that an attacker cannot inject commands.
- https://docs.python.org/3/library/shlex.html#shlex.quote
- A pull request has been made since the author did not respond to e-mail, Twitter, or IRC.
- https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff
- Regards,
- Javantea
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement