[Part 4/100] Security? Who is she
Tags: laravel, security, command, gobli
Published: 2022-08-09 14:44:00

Ignoring the 11 months since Part 3 was posted, it would be nice to share a tale between yours truly & Laravel, whomst've have tried their best avoiding a line of code that I believe is exploitable,  present for over **6 years**.

The year was 2021; upon discovering what I perceived to be an exploitable piece of code that existed within Laravel since _at least 2016_, I did what any good Samaritan would do. 
Attempted to get a CVE issued against the framework.

## The Exploit
Is a line of code within Scheduler's Command Builder that does not escape shell arguments.

I would never call myself an expert on security, but to my untrained eyes it appeared to resonate the profile of an command injection.

https://owasp.org/www-community/attacks/Command_Injection

```php
return $event->user && ! windows_os() ?
   'sudo -u '.$event->user.' -- sh -c \''.$command.'\'' : 
   $command;
```
(Formatted for readability) https://github.com/illuminate/console/blob/6678d8f63c1f0dd8fb1c98010d9893673f444e84/Scheduling/CommandBuilder.php#L73

With assistance of this line of code, using the Laravel Framework we're able to schedule the execution of _any_ arbitrary shell command (Outside of Laravel). 

## Timeline

### Feb 2021
I submit a vulnerability @ Snyk with details surrounding the supposed exploit

**Response** (excerpt)
> I recognise that the lines you pointed to show unescaped inputs. However, your description does not clarify how an attacker can alter these input parameters in the context of this package and how it's implemented by its users.

> It would be helpful if you could provide the details showing the possible attack path, or, better yet, a working PoC of an injected command.

Fair enough.

### 6 hours later
Created & replied with this PoC

{% embed https://github.com/VeryStrongFingers/laravel-shell-escape-poc %}
(Technical details are inside ^ README)

### Later in Feb 2021
Received a follow up
> I've verified the PoC you attached and have contacted the maintainers. I’ll let you know how the disclosure progresses.

### March 2021
Received a follow up
> The guys at Laravel responded as follows:

> > But, isn't users installing a malicious internal package always a security vulnerability. *ANY* package can just list a file to be autoloaded in their composer.json file that for example deletes your entire database, etc.
> 
> I think the point they're making is that they cannot (or rather, should not have to) protect against malicious vendors. In that sense, I tend to agree with them.

--
I feel it's relevant to provide OWASP's definition of a 'vulnerability' here:
> "A vulnerability is a weakness in an application (frequently a broken or missing control) that enables an attack to succeed."


### March 2021
I reply with a mini essay expressing my disagreement, but ultimately concede become I am not the security expert.

The reported vulnerability case is closed with no further action. 

### April 2022
Factoring in Laravel have stated their views on the issue, and not fixed it a year onward - I figure the 'type' of issue this would fall under is an Improvement, or Bug fix - which I would report as an issue to their GitHub repo.

{% embed https://github.com/laravel/framework/issues/42014 %}

I made the mistake of listing the affected Laravel version as "Laravel 8+"

tl;dr response
> Unfortunately we don't support this version anymore.

????

### April, 1 day later
Copy pasting the same issue content, but explicitly included "Laravel 9" this time.

https://github.com/laravel/framework/issues/42037

response:
> I don't see any big issues here. I don't see how this could lead to security issues. Please also do not publicly submit security issues, see our readme.

_Let's disregard the contradictory statements._

## In Closing

After 3 attempts of reporting what I believe is an unnecessarily existing attack vector existing within Laravel's control, I will concede;

However, genuinely curious to hear the thoughts of you lovely external unbiased readers perspectives.

Have I been pushing a non-issue? 
or are Command escape vulnerabilities not as easily recognised because this is a _web_ framework?'

Will this remain forever as is because changing it could be perceived as acknowledging it as a security issue?

P.S. In case you missed it, vector details are provided in the README of https://github.com/VeryStrongFingers/laravel-shell-escape-poc