Re: xdg-open RCE

[Brandon Perry <bperry.volatile () gmail com>]

This is very similar to this gksu bug (which only applies to gksu when in
SU_MODE)

http://savannah.nongnu.org/bugs/?40023

Attempted to email the gksu 'maintainer', but with no response.

Did a quick write up on the Rapid7 site on how I found out about it and the
vector I was using to exploit it:

https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbox-filename-command-execution-via-gksu

Was assigned the following CVE:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2886

On Fri, Nov 14, 2014 at 4:50 PM, joernchen <joernchen () phenoelit de> wrote:

> Hi,
>
> I just ran into some RCE issue with xdg-open today and figured it's known
> and unfixed since 2013-06-10 [0] (respectively 2013-07-07 upstream [1])
>
> As apparently noone cares about this I just leave a silly PoC [3]
> (should work with Chromium on Arch/Gentoo Linux) here. Additional
> requirement is a Window Manager which is _NOT_ one of the following:
>
> * KDE
> * GNOME
> * MATE
> * XFCE
> * ENLIGHTENMENT
>
>
> Cheers,
>
> joernchen
>
> [0] https://bugs.gentoo.org/show_bug.cgi?id=472888
> [1] https://bugs.freedesktop.org/show_bug.cgi?id=66670
> [3] http://phenoelit.org/stuff/xdg-open.html
> --
> joernchen ~ Phenoelit
> <joernchen () phenoelit de> ~ C776 3F67 7B95 03BF 5344
> http://www.phenoelit.de  ~ A46A 7199 8B7B 756A F5AC
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/



-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/