New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ruby: Add more potential `SystemCommandExecution` sinks #7164

Draft

alexrford wants to merge 2 commits into ruby/file-reader-extend from ruby/system-command-execution-extension

Contributor

alexrford commented Nov 17, 2021

Kernel::open, File::open etc. may invoke shell commands, e.g. in the cases of:

  file = params[:file]
  open(file)
  IO.read(file)

open and IO.open may invoke a shell command if params[:file] is a string beginning with "|".

We overapproximate here by not trying to limit these sinks based on possible argument values at runtime. This is probably better placed in queries that could add guards on potential argument values as blocking flow.

The text was updated successfully, but these errors were encountered:


          Ruby: Add more potential SystemCommandExecution sinks

935b7e0

alexrford added the Ruby label

intrigus-lgtm reviewed

ruby/ql/lib/codeql/ruby/frameworks/StandardLibrary.qll Outdated Show resolved Hide resolved

Contributor

intrigus-lgtm commented Nov 17, 2021

Some interesting CVEs for Kernel#open command injection are CVE-2017-17405 or CVE-2021-31799.
(If you don't already know them^^)
https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/
https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/


          Ruby: remove duplicated word

5efadea

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>

Contributor Author

alexrford commented Nov 18, 2021

Thanks @intrigus-lgtm, these are interesting cases that we should catch with rb/kernel-open but currently don't.

CVE-2017-17405 is missed because of an assumption that the source code for the Ruby standard library is not available as part of the database, which is the case for most databases, but not when analysing ruby/ruby itself. I think we could make improvements here by inspecting method definitions more carefully to see if they may define the Kernel#open method of the standard library.
CVE-2021-31799 is a case where the control flow graph is incomplete due to missing an entry point into the program and assuming that the vulnerable call to Kernel#open is unreachable as a result. The fix here is to ensure that the entry point is included in the database, though this may need some tooling improvements to do properly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment