CVE-2014-8990 (published 2014-12-05T16:59Z)

default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/axkibe/lsyncd
commit_details: repo_url: https://github.com/axkibe/lsyncd
author: Ángel González
author_date: 2014-11-25 23:49:25+01:00
msg: Properly sanitize mv parameters (CVE-2014-8990)

When using -rsyncssh option, some filenames
could -in addition of not syncing correctly-
crash the service and execute arbitrary commands
under the credentials of the remote user.

These issues have been assigned CVE-2014-8990

This commit fixes the incomplete and lua5.2-incompatible
sanitization performed by 18f02ad0

Signed-off-by: Sven Schwedas <sven.schwedas@tao.at>
repository: repo_url: https://github.com/axkibe/lsyncd
repo_name: lsyncd/lsyncd
description: Lsyncd (Live Syncing Daemon) synchronizes local directories with remote targets
repo_language: Lua
owner: axkibe
file_changes: filename: default-rsyncssh.lua
change_type: ModificationType.MODIFY
diff: @@ -77,8 +77,10 @@ rsyncssh.action = function( inlet )
 	-- makes move local on target host
 	-- if the move fails, it deletes the source
 	if event.etype == 'Move' then
-		local path1 = event.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
-		local path2 = event2.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
+		local path1 = config.targetdir .. event.path
+		local path2 = config.targetdir .. event2.path
+		path1 = "'" .. path1:gsub ('\'', '\'"\'"\'') .. "'"
+		path2 = "'" .. path2:gsub ('\'', '\'"\'"\'') .. "'"
 
 		log(
 			'Normal',
@@ -94,10 +96,10 @@ rsyncssh.action = function( inlet )
 			config.ssh._computed,
 			config.host,
 			'mv',
-			'\"' .. config.targetdir .. path1 .. '\"',
-			'\"' .. config.targetdir .. path2 .. '\"',
+			path1,
+			path2,
 			'||', 'rm', '-rf',
-			'\"' .. config.targetdir .. path1 .. '\"'
+			path1
 		)
 
 		return

programming_language: Lua
repo_url: https://github.com/axkibe/lsyncd
commit_details: repo_url: https://github.com/axkibe/lsyncd
author: Sven Schwedas
author_date: 2014-10-29 13:32:20+01:00
msg: Sanitize mv arguments:

1. Fixes crashes on file names containing `, $ or "
2. Also prevents shell execution of ``, $() … in file names, which can be
   used to gain remote shell access as lsyncd's (target) user.
repository: repo_url: https://github.com/axkibe/lsyncd
repo_name: lsyncd/lsyncd
description: Lsyncd (Live Syncing Daemon) synchronizes local directories with remote targets
repo_language: Lua
owner: axkibe
file_changes: filename: default-rsyncssh.lua
change_type: ModificationType.MODIFY
diff: @@ -77,6 +77,8 @@ rsyncssh.action = function( inlet )
 	-- makes move local on target host
 	-- if the move fails, it deletes the source
 	if event.etype == 'Move' then
+		local path1 = event.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
+		local path2 = event2.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$')
 
 		log(
 			'Normal',
@@ -92,10 +94,10 @@ rsyncssh.action = function( inlet )
 			config.ssh._computed,
 			config.host,
 			'mv',
-			'\"' .. config.targetdir .. event.path .. '\"',
-			'\"' .. config.targetdir .. event2.path .. '\"',
+			'\"' .. config.targetdir .. path1 .. '\"',
+			'\"' .. config.targetdir .. path2 .. '\"',
 			'||', 'rm', '-rf',
-			'\"' .. config.targetdir .. event.path .. '\"'
+			'\"' .. config.targetdir .. path1 .. '\"'
 		)
 
 		return

programming_language: Lua