CVE-2017-17514: shell argument injection via crafted URL

[bgilbert]

Hi John, CVE-2017-17514 showed up today:

boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

Except for the Debian security tracker page, I can find no information about it, so I'm guessing you weren't informed either. 8.4.0 is apparently the last version packaged by Debian, but later nip2 releases also carry the same code.

In case it's useful, there's a form for submitting updates or corrections to CVE records.

[jcupitt]

Hi Benjamin, thanks for letting me know!

My guess is that this is a false positive from an automated search for BROWSER. In nip2, BROWSER (I keep typing "bowser" by mistake and having to correct it) is not an env var, it's the name of a row in the preferences workspace.

The reference to BOX_BROWSER in boxes.c:

https://github.com/jcupitt/nip2/blob/master/src/boxes.c#L727

Fetches BROWSER from preferences:

https://github.com/jcupitt/nip2/blob/master/src/watch.h#L300

In prefs, BROWSER is equal to L2.value:

https://github.com/jcupitt/nip2/blob/master/share/nip2/start/Preferences.ws#L381

And L2 is just "firefox":

https://github.com/jcupitt/nip2/blob/master/share/nip2/start/Preferences.ws#L740

I'll try submitting a correction, with this issue as evidence.

[jcupitt]

OK, I've asked for the issue to be closed, request number 434637. I'll update if I hear back.

Thanks again!

[bgilbert]

Hi John, where does the URL argument come from? Is it possible that a malicious workspace could embed a URL with a semicolon and a shell command?

[jcupitt]

helpindex.h links help tags in the source to references to pages in the manual, it can't be changed by the workspace.

The preferences are kept as a workspace, but it's a special one that nip2 loads directly.

[jcupitt]

It's true that if an attacker could modify the prefs file (the user's personal one is kept in ~/.nip2-x.y.x/start/Preferences.ws), then they could make nip2 execute some arbitrary code the next time the user pressed F1.

Does that count as a vulnerability? If they can modify that file, they can modify ~/.profile as well, which would be just as serious.

[bgilbert]

I don't think an attack that requires the attacker to modify the prefs file is a meaningful vulnerability, provided that there's no way for a workspace to do that autonomously.

I see the CVE entry is now marked DISPUTED.