Re: Ruby gem Thumbshooter 0.1.5 remote code execution

["Larry W. Cashdollar" <larry0 () me com>]

Hello all,

May I please have a CVE assigned to this vulnerability? 

Thanks!

On Mar 26, 2013, at 04:23 AM, larry Cashdollar <larry0 () me com> wrote:

> Ruby gem Thumbshooter 0.1.5 remote code execution
>
> 3/25/2013
> Generates thumbshots of URLs by using Webkit and QT4.
>
> https://github.com/digineo/thumbshooter
>
> Specially crafted URLs can result in remote code execution if the URL contains shell metacharacters.
>
> We see that the url is passed directly to the shell in the following code snippet from 
> ./thumbshooter-0.1.5/lib/thumbshooter.rb lines:
>
> 1012 command << "xvfb-run -a --server-args='-screen 0, #{screen}x24' "
> 1015 command << "{WEBKIT2PNG} '{url}' {args}"
> 1017 img = `{command} 2>&1`
> Larry W. Cashdollar
> @_larry0
> http://vapid.dhs.org/advisories/thumbshooter-ruby-gem-remoteexec.html
>
>
> Larry C$