Command Injection: in nasa/fprime
Reported on
Jun 27th 2022
Description
cookiecutter is a command-line utility that creates projects from cookiecutters.
Affected versions of this package are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Proof of Concept
from cookiecutter.main import cookiecutter
checkout = "--config=alias.checkout=!touch ./HELLO" cookiecutter('some valid hg repository', checkout=checkout)
Impact
Arbitrary code execution -->
Ability to run any commands or code of the choice
Occurrences
SECURITY.md
a year ago
fprime-util new is vulnerable, but this isn't particularly concerning. Users shouldn't be using untrusted sources of cookiecutten templates for generating fprime components. Until this can be fixed this vulnerability should be publicly disclosed so that users know the risks of using untrusted templates.
Sir, can you please clarify this statement? :)
As far as I understood, now you too get about the vulnerability.
Kind regards,
I'm not privileged to disclose on this platform. @admin Can you favor this?
@7h3h4ckv157 @joshua-anderson - this vulnerability report is now publicly accessible and can be shared freely 👍
It is really up to the maintainer. If they believe this to be a vulnerability against the project, we do generally recommend marking the report as valid, however, if it does not have significant enough of an impact such that it does not require a fix, we recommend marking it as informative.
@maintainer - thoughts?
I respect both options raised by the admin. But, IMHO I will recommend the 1st, coz You already detected it as a vulnerability. But the final choice is yours though! - @maintainer :)
Kind regards
Absolutely @Kiran - we can donate the bounty to the maintainer. Once the @Joshua has attached a fix to this report and selected themselves as the fixer, we can provide them with the bounty.
We have upgraded to 2.1.1. This is the suggested fix.
