CVE-2020-14001 (published 2020-07-17T16:15Z)

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/gettalong/kramdown
commit_details: repo_url: https://github.com/gettalong/kramdown
author: Thomas Leitner
author_date: 2020-06-27 14:47:21+02:00
msg: Add option forbidden_inline_options

It is sometimes necessary to restrict the options that can be set
inline, ie. using the {::options ...} extensions.

By default, the template option is now forbidden to avoid possible
security problems. This addresses CVE-2020-14001.
repository: repo_url: https://github.com/gettalong/kramdown
repo_name: gettalong/kramdown
description: kramdown is a fast, pure Ruby Markdown superset converter, using a strict syntax definition and supporting several common extensions.
repo_language: Ruby
owner: gettalong
file_changes: filename: options.rb
change_type: ModificationType.MODIFY
diff: @@ -589,6 +589,16 @@ module Kramdown
       Used by: HTML converter
     EOF
 
+    define(:forbidden_inline_options, Object, %w[template], <<~EOF) do |val|
+      Defines the options that may not be set using the {::options} extension
+
+      Default: template
+      Used by: HTML converter
+    EOF
+      val.map! {|item| item.kind_of?(String) ? str_to_sym(item) : item }
+      simple_array_validator(val, :forbidden_inline_options)
+    end
+
   end
 
 end

programming_language: Ruby
filename: extensions.rb
change_type: ModificationType.MODIFY
diff: @@ -110,6 +110,12 @@ module Kramdown
           opts.select do |k, v|
             k = k.to_sym
             if Kramdown::Options.defined?(k)
+              if @options[:forbidden_inline_options].include?(k) ||
+                  k == :forbidden_inline_options
+                warning("Option #{k} may not be set inline")
+                next false
+              end
+
               begin
                 val = Kramdown::Options.parse(k, v)
                 @options[k] = val

programming_language: Ruby
filename: options.text
change_type: ModificationType.MODIFY
diff: @@ -19,3 +19,5 @@ some <span>*para*</span>
 Some text[^ab].
 
 [^ab]: Some text.
+
+{::options template="/etc/passwd" /}

programming_language: Markdown