CVE-2014-9489 (published 2017-10-17T14:29Z)

The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-284
cwe_name: Improper Access Control
description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
extended_description: 
            Access control involves the use of several protection mechanisms such as:
            
               Authentication (proving the identity of an actor)
               Authorization (ensuring that a given actor can access a resource), and
               Accountability (tracking of activities that were performed)
            
            When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
            There are two distinct behaviors that can introduce access control weaknesses:
               
                  Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
                  Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
               
         
		 

Fix information:
repo_url: https://github.com/gollum/grit_adapter
commit_details: repo_url: https://github.com/gollum/grit_adapter
author: Dawa Ometto
author_date: 2014-12-04 13:45:17+01:00
msg: Fix security issue with git grep -O
repository: repo_url: https://github.com/gollum/grit_adapter
repo_name: gollum/grit_adapter
description: Adapter for Gollum to use Grit at the backend
repo_language: Ruby
owner: gollum
file_changes: filename: git_layer_grit.rb
change_type: ModificationType.MODIFY
diff: @@ -136,6 +136,8 @@ module Gollum
       
       def grep(query, options={})
         ref = options[:ref] ? options[:ref] : "HEAD"
+        query = Shellwords.split(query).select {|q| !(q =~ /^(-O)|(--open-files-in-pager)/) }
+        query = Shellwords.join(query)
         args = [{}, '-I', '-i', '-c', query, ref, '--']
         args << options[:path] if options[:path]
         result = @git.grep(*args).split("\n")
@@ -165,6 +167,7 @@ module Gollum
       
       def ls_files(query, options = {})
         options[:ref] = options[:ref] ? options[:ref] : "HEAD"
+        query = Shellwords.shellescape(query)
         @git.ls_files({}, "*#{query}*").split("\n")
       end
       

programming_language: Ruby