CVE-2017-11421: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the "Bad Taste" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 7.8
Published: 2017-07-18T19:29Z
Repository: https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer
Language: Other
Files changed: usr/bin/gnome-exe-thumbnailer
Commit date: 2017-07-18 07:41:17 +0800
Commit message: Switch to msitools' msiinfo for ProductVersion fetching

This replaces the insecure VBScript-based parsing, which has issues described at http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html

Diff: diff --git a/usr/bin/gnome-exe-thumbnailer b/usr/bin/gnome-exe-thumbnailer
index 3f382a8..a7f1edd 100755
--- a/usr/bin/gnome-exe-thumbnailer
+++ b/usr/bin/gnome-exe-thumbnailer
@@ -354,29 +354,14 @@ else
 fi
 
 # Get the version number:
 if [[ ${INPUTFILE##*.} = 'msi' ]]
 then
-	# Look for the ProductVersion property if user has the Microsoft (R) Windows Script Host installed:
-	if which wine && grep -v 'Wine placeholder DLL' $HOME/.wine/drive_c/windows/system32/cscript.exe
+	# Look for the ProductVersion property using msitools' msiinfo if present
+	if which msiinfo
 	then
-		# Workaround wine bug #19799: cscript crashes if you call WScript.Arguments(0)
-		# http://bugs.winehq.org/show_bug.cgi?id=19799
-		<<< "
-			Dim WI, DB, View, Record
-			Set WI = CreateObject(\"WindowsInstaller.Installer\")
-			Set DB = WI.OpenDatabase(\"$INPUTFILE\",0)
-			Set View = DB.OpenView(\"SELECT Value FROM Property WHERE Property = 'ProductVersion'\")
-			View.Execute
-			Wscript.Echo View.Fetch.StringData(1)
-		" iconv -f utf8 -t unicode > $TEMPFILE1.vbs
-
-		VERSION=$(
-			DISPLAY=NONE wine cscript.exe //E:vbs //NoLogo Z:\\tmp\\${TEMPFILE1##*/}.vbs 2>/dev/null \
-			| egrep -o '^[0-9]+\.[0-9]+(\.[0-9][0-9]?)?(beta)?'
-		)
-
+		VERSION=$(msiinfo export "$INPUTFILE" 'Property' | grep 'ProductVersion' | cut -f 2)
 	else
 		# Try to get the version number from extended file properties at least:
 		VERSION=$(
 			file "$INPUTFILE" \
 			| grep -o ', Subject: .*, Author: ' \

Vulnerable code: 	# Look for the ProductVersion property if user has the Microsoft (R) Windows Script Host installed:
	if which wine && grep -v 'Wine placeholder DLL' $HOME/.wine/drive_c/windows/system32/cscript.exe
		# Workaround wine bug #19799: cscript crashes if you call WScript.Arguments(0)
		# http://bugs.winehq.org/show_bug.cgi?id=19799
		<<< "
			Dim WI, DB, View, Record
			Set WI = CreateObject(\"WindowsInstaller.Installer\")
			Set DB = WI.OpenDatabase(\"$INPUTFILE\",0)
			Set View = DB.OpenView(\"SELECT Value FROM Property WHERE Property = 'ProductVersion'\")
			View.Execute
			Wscript.Echo View.Fetch.StringData(1)
		" iconv -f utf8 -t unicode > $TEMPFILE1.vbs

		VERSION=$(
			DISPLAY=NONE wine cscript.exe //E:vbs //NoLogo Z:\\tmp\\${TEMPFILE1##*/}.vbs 2>/dev/null \
			| egrep -o '^[0-9]+\.[0-9]+(\.[0-9][0-9]?)?(beta)?'
		)

Fixed code: 	# Look for the ProductVersion property using msitools' msiinfo if present
	if which msiinfo
		VERSION=$(msiinfo export "$INPUTFILE" 'Property' | grep 'ProductVersion' | cut -f 2)