A proof-of-concept of a vulnerability in custom shell prompt scripts • Hacker News Board

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#11

Post by eridius » Fri, Mar 17, 2017, 9:00 PM UTC

chadgeidel wrote: post #9

Forgive me if I'm misunderstanding the vulnerability, but isn't this one of Raymond Chen's "It rather involved being on the other side of this airtight hatchway" exploits? That is, any commands you run has the same permissions as you have. Now, I understand that you may not intimately understand 100% the code of the commands and shell extensions you use, but is that a "vulnerability"?

Cloning a repository and cd'ing into it should always be safe, no matter what that repository is. This vulnerability makes it not safe.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#12

Post by Ajedi32 » Fri, Mar 17, 2017, 9:01 PM UTC

chadgeidel wrote: post #9

Forgive me if I'm misunderstanding the vulnerability, but isn't this one of Raymond Chen's "It rather involved being on the other side of this airtight hatchway" exploits? That is, any commands you run has the same permissions as you have. Now, I understand that you may not intimately understand 100% the code of the commands and shell extensions you use, but is that a "vulnerability"?

If allows an attacker to execute arbitrary code in a situation where you wouldn't expect that (such as merely CDing to an attacker-controlled directory), then yeah of course it's a vulnerability.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#13

Post by tristor » Fri, Mar 17, 2017, 9:01 PM UTC

Nice find. Luckily I am hyper-paranoid about escaping, so even though my custom jankery is probably not as performant as it could be, it's not vulnerable to this or similar exploits.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#14

Post by caf » Fri, Mar 17, 2017, 9:02 PM UTC

rahiel wrote: post #4

The "official" git prompt[1] is safe on Bash; the script doesn't run. [1]: https://github.com/git/git/blob/master/contrib/completion/gi...

In particular see the long comment at line 324.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#15

Post by neoromantique » Fri, Mar 17, 2017, 9:03 PM UTC

ohmyzsh is vulnerable.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#16

Post by jaegerpicker » Fri, Mar 17, 2017, 9:04 PM UTC

My OSX shell prompt is vunerable, I'm using zsh, oh-my-zsh, and powerlevel9k/powerlevel9k as my theme.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#17

Post by wnevets » Fri, Mar 17, 2017, 9:04 PM UTC

git for windows seems to be fine.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#18

Post by lillesvin » Fri, Mar 17, 2017, 9:05 PM UTC

Cute idea. I'm willing to bet that the Bash script I wrote for some of my co-workers is vulnerable. I guess that's something I should find out ... by making their computers do stuff.

However, I currently use Fish shell myself and it seems to be safe: http://imgur.com/a/rjocA

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#19

Post by nathankleyn » Fri, Mar 17, 2017, 9:06 PM UTC

mikey_p wrote: post #8

On fish and omf here, not vulnerable. I suppose I should test fisherman on my other machine as well.

I've confirmed fisherman is safe on my machine.

Re: A proof-of-concept of a vulnerability in custom shell prompt scripts

#20

Post by shawkinaw » Fri, Mar 17, 2017, 9:07 PM UTC

Liquid Prompt [0] seems safe.

[0] https://github.com/nojhan/liquidprompt