CVE-2017-18026 (Ruby, published 2018-01-10T09:29Z)
Description: value: Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/redmine/redmine
Files changed:
lib/redmine/scm/adapters/mercurial_adapter.rb
test/unit/lib/redmine/scm/adapters/mercurial_adapter_test.rb
Commit message: mercurial: work around faulty parsing of early command options (#27516)

Use -sVALUE and --long=VALUE instead of "-s VALUE" and "--long VALUE"
respectively.

Contributed by Yuya Nishihara.

git-svn-id: http://svn.redmine.org/redmine/trunk@17062 e93f8b46-1217-0410-a6f0-8f06a7374b81


Vulnerable code:
          manifest = hg('rhmanifest', '-r', CGI.escape(hgrev(identifier)),
          hg_args = ['log', '--debug', '-C', '--style', self.class.template_path]
          hg_args << '-r' << "#{hgrev(identifier_from)}:#{hgrev(identifier_to)}"
          hg_args << '--limit' << options[:limit] if options[:limit]
          hg_args = ['rhlog', '--template', '{node}\n', '--rhbranch', CGI.escape(branch)]
          hg_args << '--from' << CGI.escape(branch)
          hg_args << '--to'   << '0'
          hg_args << '--limit' << options[:limit] if options[:limit]
            hg_args << '-r' << hgrev(identifier_to) << '-r' << hgrev(identifier_from)
            hg_args << '-c' << hgrev(identifier_from)
          hg 'rhcat', '-r', CGI.escape(hgrev(identifier)), '--', hgtarget(p) do |io|
          hg 'rhannotate', '-ncu', '-r', CGI.escape(hgrev(identifier)), '--', hgtarget(p) do |io|
          full_args = ['-R', repo_path, '--encoding', 'utf-8']
      assert_raise HgCommandArgumentError do
        @adapter.diff('sources/welcome_controller.rb', '--config=alias.rhdiff=!xterm')
      end
      assert_raise HgCommandArgumentError do
      assert_raise HgCommandArgumentError do
      assert_raise HgCommandArgumentError do

Fixed code:
          manifest = hg('rhmanifest', "-r#{CGI.escape(hgrev(identifier))}",
          hg_args = ['log', '--debug', '-C', "--style=#{self.class.template_path}"]
          hg_args << "-r#{hgrev(identifier_from)}:#{hgrev(identifier_to)}"
          hg_args << "--limit=#{options[:limit]}" if options[:limit]
          hg_args = ['rhlog', '--template={node}\n', "--rhbranch=#{CGI.escape(branch)}"]
          hg_args << "--from=#{CGI.escape(branch)}"
          hg_args << '--to=0'
          hg_args << "--limit=#{options[:limit]}" if options[:limit]
            hg_args << "-r#{hgrev(identifier_to)}" << "-r#{hgrev(identifier_from)}"
            hg_args << "-c#{hgrev(identifier_from)}"
          hg 'rhcat', "-r#{CGI.escape(hgrev(identifier))}", '--', hgtarget(p) do |io|
          hg 'rhannotate', '-ncu', "-r#{CGI.escape(hgrev(identifier))}", '--', hgtarget(p) do |io|
          full_args = ["-R#{repo_path}", '--encoding=utf-8']
          # don't use "--config=<value>" form for compatibility with ancient Mercurial
  HgCommandAborted   = Redmine::Scm::Adapters::MercurialAdapter::HgCommandAborted
      assert_nil @adapter.diff('sources/welcome_controller.rb',
                               '--config=alias.rhdiff=!xterm')
      assert_raise HgCommandAborted do
      assert_raise HgCommandAborted do
      assert_raise HgCommandAborted do