Hi, the SECURITY.md template is blank and doesn't specify a private reporting method. If possible, please restrict the visibility of this issue or let me know an email to contact.
There is an OS Command Injection vulnerability in the ip link show handler. User input from argv is concatenated directly into a shell command without sanitization:
status, res = subprocess.getstatusoutput(IFCONFIG + " -v " + param + " 2>/dev/null")
Because subprocess.getstatusoutput uses shell=True under the hood, an attacker can break out of the intended command.
Proof of Concept:
ip link show "eth0; id"
This will execute the id command on the host machine.
Suggested Fix:
Sanitize the input using shlex.quote(param) before concatenation, or switch to subprocess.run([IFCONFIG, "-v", param], shell=False).
CVE Request:
I would like to request a CVE ID for this finding. Are you able to coordinate with a CNA to assign one, or would you prefer if I reach out to a CNA (like GitHub Security Lab) on your behalf to get it assigned?
Hi, the SECURITY.md template is blank and doesn't specify a private reporting method. If possible, please restrict the visibility of this issue or let me know an email to contact.
There is an OS Command Injection vulnerability in the
ip link showhandler. User input fromargvis concatenated directly into a shell command without sanitization:status, res = subprocess.getstatusoutput(IFCONFIG + " -v " + param + " 2>/dev/null")Because
subprocess.getstatusoutputusesshell=Trueunder the hood, an attacker can break out of the intended command.Proof of Concept:
ip link show "eth0; id"This will execute the
idcommand on the host machine.Suggested Fix:
Sanitize the input using
shlex.quote(param)before concatenation, or switch tosubprocess.run([IFCONFIG, "-v", param], shell=False).CVE Request:
I would like to request a CVE ID for this finding. Are you able to coordinate with a CNA to assign one, or would you prefer if I reach out to a CNA (like GitHub Security Lab) on your behalf to get it assigned?