CVE-2011-0469: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2017-08-17T16:29Z
Repository: https://github.com/openSUSE/open-build-service
Language: Shell
Files changed: src/backend/call-service-in-lxc.sh
Commit date: 2011-03-14 11:01:03 +0100
Commit message: [backend] fix argument handling in lxc command execution

Diff: diff --git a/src/backend/call-service-in-lxc.sh b/src/backend/call-service-in-lxc.sh
old mode 100644
new mode 100755
index 4cc7e9b8..888c361e
--- a/src/backend/call-service-in-lxc.sh
+++ b/src/backend/call-service-in-lxc.sh
@@ -29,27 +29,25 @@ chown -R $RUNUSER "$MOUNTDIR/$INNERSRCDIR" .
 mount --bind "$PWD" "$MOUNTDIR/$INNERSRCDIR/"
 
 echo "#!/bin/bash" > "$MOUNTDIR/$INNERSCRIPT"
 echo "cd $INNERSRCDIR" >> "$MOUNTDIR/$INNERSCRIPT"
 
-MODE=""
-WITH_NET=""
-COMMAND=""
+WITH_NET="0"
+COMMAND="$1"
+shift
+case "$COMMAND" in
+  */download_url|*/tar_scm|*/download_src_package|*/update_source|*/download_files)
+    WITH_NET="1"
+    ;;
+esac
 
 while [ $# -gt 0 ]; do
   if [ "$1" == "--outdir" ] ; then
      shift
      OUTDIR="$1"
   else
-     COMMAND="$COMMAND \"${1/\"/_}\" "
-     if [ -z "$MODE" ]; then
-        case "$1" in
-          */download_url|*/tar_scm|*/download_src_package|*/update_source|*/download_files)
-            WITH_NET="1"
-            ;;
-        esac
-     fi
+     COMMAND="$COMMAND '${1//\'/_}'"
   fi
   shift
 done
 
 if [ -z "$OUTDIR" ] ; then
@@ -61,16 +59,17 @@ mount --bind "$OUTDIR" "$MOUNTDIR$INNEROUTDIR" || exit 1
 chown -R $RUNUSER "$MOUNTDIR/$INNEROUTDIR"
 
 #if [ "$WITH_NET" == "1" ] ; then
 #  echo "rcnscd start" >> "$MOUNTDIR/$INNERSCRIPT"
 #fi
-echo -n "su $RUNUSER -c '" >> "$MOUNTDIR/$INNERSCRIPT"
-echo "$COMMAND --outdir $INNEROUTDIR'" >> "$MOUNTDIR/$INNERSCRIPT"
-chmod 0755 "$MOUNTDIR/$INNERSCRIPT"
+echo -n "su $RUNUSER -s ${INNERSCRIPT}.command" >> "$MOUNTDIR/$INNERSCRIPT"
+echo "#!/bin/bash"               >  "$MOUNTDIR/${INNERSCRIPT}.command"
+echo "${COMMAND[@]} --outdir $OUTDIR" >> "$MOUNTDIR/${INNERSCRIPT}.command"
+chmod 0755 "$MOUNTDIR/$INNERSCRIPT" "$MOUNTDIR/${INNERSCRIPT}.command"
 
 # construct jail
-LXC_CONF="/tmp/obs.service.$$"
+LXC_CONF="/obs.service.$$"
 echo "lxc.utsname = obs.service.$$" > $LXC_CONF
 if [ "$WITH_NET" == "1" ] ; then
   mount -t proc proc $MOUNTDIR/proc
 else
   echo "lxc.network.type = empty" >> $LXC_CONF

Vulnerable code: MODE=""
WITH_NET=""
COMMAND=""
     COMMAND="$COMMAND \"${1/\"/_}\" "
     if [ -z "$MODE" ]; then
        case "$1" in
          */download_url|*/tar_scm|*/download_src_package|*/update_source|*/download_files)
            WITH_NET="1"
            ;;
        esac
     fi
echo -n "su $RUNUSER -c '" >> "$MOUNTDIR/$INNERSCRIPT"
echo "$COMMAND --outdir $INNEROUTDIR'" >> "$MOUNTDIR/$INNERSCRIPT"
chmod 0755 "$MOUNTDIR/$INNERSCRIPT"
LXC_CONF="/tmp/obs.service.$$"
Fixed code: WITH_NET="0"
COMMAND="$1"
shift
case "$COMMAND" in
  */download_url|*/tar_scm|*/download_src_package|*/update_source|*/download_files)
    WITH_NET="1"
    ;;
esac
     COMMAND="$COMMAND '${1//\'/_}'"
echo -n "su $RUNUSER -s ${INNERSCRIPT}.command" >> "$MOUNTDIR/$INNERSCRIPT"
echo "#!/bin/bash"               >  "$MOUNTDIR/${INNERSCRIPT}.command"
echo "${COMMAND[@]} --outdir $OUTDIR" >> "$MOUNTDIR/${INNERSCRIPT}.command"
chmod 0755 "$MOUNTDIR/$INNERSCRIPT" "$MOUNTDIR/${INNERSCRIPT}.command"
LXC_CONF="/obs.service.$$"