CVE-2017-18026: Insufficient Information (NVD-CWE-noinfo)
value: Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2018-01-10T09:29Z
Repository: https://github.com/redmine/redmine
Language: Ruby
Files changed: lib/redmine/scm/adapters/mercurial_adapter.rb, test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb
Commit date: 2017-12-07 11:38:47 +0000
Commit message: mercurial: work around faulty parsing of early command options (#27516)

Use -sVALUE and --long=VALUE instead of "-s VALUE" and "--long VALUE"
respectively.

Contributed by Yuya Nishihara.

git-svn-id: http://svn.redmine.org/redmine/trunk@17062 e93f8b46-1217-0410-a6f0-8f06a7374b81

Diff: diff --git a/lib/redmine/scm/adapters/mercurial_adapter.rb b/lib/redmine/scm/adapters/mercurial_adapter.rb
index 0e7f766d47..599c3a42fa 100644
--- a/lib/redmine/scm/adapters/mercurial_adapter.rb
+++ b/lib/redmine/scm/adapters/mercurial_adapter.rb
@@ -138,11 +138,11 @@ module Redmine
         end
         private :summary
 
         def entries(path=nil, identifier=nil, options={})
           p1 = scm_iconv(@path_encoding, 'UTF-8', path)
-          manifest = hg('rhmanifest', '-r', CGI.escape(hgrev(identifier)),
+          manifest = hg('rhmanifest', "-r#{CGI.escape(hgrev(identifier))}",
                         '--', CGI.escape(without_leading_slash(p1.to_s))) do |io|
             output = io.read.force_encoding('UTF-8')
             begin
               parse_xml(output)['rhmanifest']['repository']['manifest']
             rescue
@@ -179,13 +179,13 @@ module Redmine
         end
 
         # Iterates the revisions by using a template file that
         # makes Mercurial produce a xml output.
         def each_revision(path=nil, identifier_from=nil, identifier_to=nil, options={})
-          hg_args = ['log', '--debug', '-C', '--style', self.class.template_path]
-          hg_args << '-r' << "#{hgrev(identifier_from)}:#{hgrev(identifier_to)}"
-          hg_args << '--limit' << options[:limit] if options[:limit]
+          hg_args = ['log', '--debug', '-C', "--style=#{self.class.template_path}"]
+          hg_args << "-r#{hgrev(identifier_from)}:#{hgrev(identifier_to)}"
+          hg_args << "--limit=#{options[:limit]}" if options[:limit]
           hg_args << '--' << hgtarget(path) unless path.blank?
           log = hg(*hg_args) do |io|
             output = io.read.force_encoding('UTF-8')
             begin
               # Mercurial < 1.5 does not support footer template for '</log>'
@@ -222,23 +222,23 @@ module Redmine
           self
         end
 
         # Returns list of nodes in the specified branch
         def nodes_in_branch(branch, options={})
-          hg_args = ['rhlog', '--template', '{node}\n', '--rhbranch', CGI.escape(branch)]
-          hg_args << '--from' << CGI.escape(branch)
-          hg_args << '--to'   << '0'
-          hg_args << '--limit' << options[:limit] if options[:limit]
+          hg_args = ['rhlog', '--template={node}\n', "--rhbranch=#{CGI.escape(branch)}"]
+          hg_args << "--from=#{CGI.escape(branch)}"
+          hg_args << '--to=0'
+          hg_args << "--limit=#{options[:limit]}" if options[:limit]
           hg(*hg_args) { |io| io.readlines.map { |e| e.chomp } }
         end
 
         def diff(path, identifier_from, identifier_to=nil)
           hg_args = %w|rhdiff|
           if identifier_to
-            hg_args << '-r' << hgrev(identifier_to) << '-r' << hgrev(identifier_from)
+            hg_args << "-r#{hgrev(identifier_to)}" << "-r#{hgrev(identifier_from)}"
           else
-            hg_args << '-c' << hgrev(identifier_from)
+            hg_args << "-c#{hgrev(identifier_from)}"
           end
           unless path.blank?
             p = scm_iconv(@path_encoding, 'UTF-8', path)
             hg_args << '--' << CGI.escape(hgtarget(p))
           end
@@ -253,22 +253,22 @@ module Redmine
           nil  # means not found
         end
 
         def cat(path, identifier=nil)
           p = CGI.escape(scm_iconv(@path_encoding, 'UTF-8', path))
-          hg 'rhcat', '-r', CGI.escape(hgrev(identifier)), '--', hgtarget(p) do |io|
+          hg 'rhcat', "-r#{CGI.escape(hgrev(identifier))}", '--', hgtarget(p) do |io|
             io.binmode
             io.read
           end
         rescue HgCommandAborted
           nil  # means not found
         end
 
         def annotate(path, identifier=nil)
           p = CGI.escape(scm_iconv(@path_encoding, 'UTF-8', path))
           blame = Annotate.new
-          hg 'rhannotate', '-ncu', '-r', CGI.escape(hgrev(identifier)), '--', hgtarget(p) do |io|
+          hg 'rhannotate', '-ncu', "-r#{CGI.escape(hgrev(identifier))}", '--', hgtarget(p) do |io|
             io.each_line do |line|
               line.force_encoding('ASCII-8BIT')
               next unless line =~ %r{^([^:]+)\s(\d+)\s([0-9a-f]+):\s(.*)$}
               r = Revision.new(:author => $1.strip, :revision => $2, :scmid => $3,
                                :identifier => $3)
@@ -302,11 +302,12 @@ module Redmine
           if args.take_while { |s| s != '--' }.any? { |s| s =~ HG_EARLY_LIST_ARG }
             raise HgCommandArgumentError, "malicious command argument detected"
           end
 
           repo_path = root_url || url
-          full_args = ['-R', repo_path, '--encoding', 'utf-8']
+          full_args = ["-R#{repo_path}", '--encoding=utf-8']
+          # don't use "--config=<value>" form for compatibility with ancient Mercurial
           full_args << '--config' << "extensions.redminehelper=#{HG_HELPER_EXT}"
           full_args << '--config' << 'diff.git=false'
           full_args += args
           ret = shellout(
                    self.class.sq_bin + ' ' + full_args.map { |e| shell_quote e.to_s }.join(' '),
diff --git a/test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb b/test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb
index e0458ce55a..4f891602a3 100644
--- a/test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb
+++ b/test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb
@@ -19,10 +19,11 @@ require File.expand_path('../../../../../../test_helper', __FILE__)
 
 class MercurialAdapterTest < ActiveSupport::TestCase
   HELPERS_DIR        = Redmine::Scm::Adapters::MercurialAdapter::HELPERS_DIR
   TEMPLATE_NAME      = Redmine::Scm::Adapters::MercurialAdapter::TEMPLATE_NAME
   TEMPLATE_EXTENSION = Redmine::Scm::Adapters::MercurialAdapter::TEMPLATE_EXTENSION
+  HgCommandAborted   = Redmine::Scm::Adapters::MercurialAdapter::HgCommandAborted
   HgCommandArgumentError = Redmine::Scm::Adapters::MercurialAdapter::HgCommandArgumentError
 
   REPOSITORY_PATH = repository_path('mercurial')
   CHAR_1_HEX = "\xc3\x9c"
 
@@ -443,23 +444,22 @@ class MercurialAdapterTest < ActiveSupport::TestCase
                               )
       assert_equal "UTF-8", adpt2.path_encoding
     end
 
     def test_bad_early_options
-      assert_raise HgCommandArgumentError do
-        @adapter.diff('sources/welcome_controller.rb', '--config=alias.rhdiff=!xterm')
-      end
+      assert_nil @adapter.diff('sources/welcome_controller.rb',
+                               '--config=alias.rhdiff=!xterm')
       assert_raise HgCommandArgumentError do
         @adapter.entries('--debugger')
       end
-      assert_raise HgCommandArgumentError do
+      assert_raise HgCommandAborted do
         @adapter.revisions(nil, nil, nil, limit: '--repo=otherrepo')
       end
-      assert_raise HgCommandArgumentError do
+      assert_raise HgCommandAborted do
         @adapter.nodes_in_branch('default', limit: '--repository=otherrepo')
       end
-      assert_raise HgCommandArgumentError do
+      assert_raise HgCommandAborted do
         @adapter.nodes_in_branch('-Rotherrepo')
       end
     end
 
     private

Vulnerable code:           manifest = hg('rhmanifest', '-r', CGI.escape(hgrev(identifier)),
          hg_args = ['log', '--debug', '-C', '--style', self.class.template_path]
          hg_args << '-r' << "#{hgrev(identifier_from)}:#{hgrev(identifier_to)}"
          hg_args << '--limit' << options[:limit] if options[:limit]
          hg_args = ['rhlog', '--template', '{node}\n', '--rhbranch', CGI.escape(branch)]
          hg_args << '--from' << CGI.escape(branch)
          hg_args << '--to'   << '0'
          hg_args << '--limit' << options[:limit] if options[:limit]
            hg_args << '-r' << hgrev(identifier_to) << '-r' << hgrev(identifier_from)
            hg_args << '-c' << hgrev(identifier_from)
          hg 'rhcat', '-r', CGI.escape(hgrev(identifier)), '--', hgtarget(p) do |io|
          hg 'rhannotate', '-ncu', '-r', CGI.escape(hgrev(identifier)), '--', hgtarget(p) do |io|
          full_args = ['-R', repo_path, '--encoding', 'utf-8']
      assert_raise HgCommandArgumentError do
        @adapter.diff('sources/welcome_controller.rb', '--config=alias.rhdiff=!xterm')
      end
      assert_raise HgCommandArgumentError do
      assert_raise HgCommandArgumentError do
      assert_raise HgCommandArgumentError do
Fixed code:           manifest = hg('rhmanifest', "-r#{CGI.escape(hgrev(identifier))}",
          hg_args = ['log', '--debug', '-C', "--style=#{self.class.template_path}"]
          hg_args << "-r#{hgrev(identifier_from)}:#{hgrev(identifier_to)}"
          hg_args << "--limit=#{options[:limit]}" if options[:limit]
          hg_args = ['rhlog', '--template={node}\n', "--rhbranch=#{CGI.escape(branch)}"]
          hg_args << "--from=#{CGI.escape(branch)}"
          hg_args << '--to=0'
          hg_args << "--limit=#{options[:limit]}" if options[:limit]
            hg_args << "-r#{hgrev(identifier_to)}" << "-r#{hgrev(identifier_from)}"
            hg_args << "-c#{hgrev(identifier_from)}"
          hg 'rhcat', "-r#{CGI.escape(hgrev(identifier))}", '--', hgtarget(p) do |io|
          hg 'rhannotate', '-ncu', "-r#{CGI.escape(hgrev(identifier))}", '--', hgtarget(p) do |io|
          full_args = ["-R#{repo_path}", '--encoding=utf-8']
          # don't use "--config=<value>" form for compatibility with ancient Mercurial
  HgCommandAborted   = Redmine::Scm::Adapters::MercurialAdapter::HgCommandAborted
      assert_nil @adapter.diff('sources/welcome_controller.rb',
                               '--config=alias.rhdiff=!xterm')
      assert_raise HgCommandAborted do
      assert_raise HgCommandAborted do
      assert_raise HgCommandAborted do