Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arbitrary file execution in TZinfo (Ruby)

github.com

Post reply on HN
Print view View original

1–10 of 30 posts

Re: Arbitrary file execution in TZinfo (Ruby)

#5

Post by freeqaz »

Do any Ruby devs have an idea about how widely exploitable this vulnerability is? The GitHub issue mentions that a file upload could trigger this.

I'm guessing that's because the time zone is included in the "date modified" field, but that's just a hunch.

If anybody is able to quickly spin up a Ruby on Rails app with a file uploader, I bet somebody be happy to bang on it and see if they can get an exploit to trigger. (I'm headed to sleep now, but that will be a fun challenge to dig into tomorrow.)

If this turns out to be something impactful and widespread, I'll tweet/blog[0] about it and give a shout out to anybody that helps on a POC. Raising awareness so that people are aware of RCE vectors like this one is important for making sure people update.

(I'm guessing that somebody clever will figure out a "gadget-like" way to get RCE with this on a base Ruby install by loading in specific files from the disk. Ie, you will no longer need arbitrary file write access to the disk in order to turn this into RCE. That would scenario would make this CVE a much more widely exploitable attack, versus being fairly niche due to needing a more specific setup. I'm no Ruby expert, so maybe I'm totally wrong here.)

0: https://twitter.com/lunasecio

Re: Arbitrary file execution in TZinfo (Ruby)

#6

Post by masklinn »

freeqaz wrote: post #5

Do any Ruby devs have an idea about how widely exploitable this vulnerability is? The GitHub issue mentions that a file upload could trigger this. I'm guessing that's because the time zone is included in the "date modified" field, but that's just a hunch. If anybody is able to quickly spin up a Ruby on Rails app with a file uploader, I bet somebody be happy to bang on it and see if they can get an exploit to trigger.…

> I'm guessing that's because the time zone is included in the "date modified" field, but that's just a hunch.

From reading the description it looks like the second line, if present, is just (somehow) loaded as a ruby file.

So this is exploitable on a file upload if you can find the destination location of the upload data. More generally if you can get a ruby script on the FS somehow, and this is accessible from the tzinfo-gem via a relative path, and you can probe the FS (but depending on the error feedback the vulnerability itself could provide the probing tool, if it lets you discriminate between EFILE and EEXIST… or if rails has a standard upload path and the average application will almost certainly be using that)

Re: Arbitrary file execution in TZinfo (Ruby)

#7

Post by [deleted] »

freeqaz wrote: post #5

Do any Ruby devs have an idea about how widely exploitable this vulnerability is? The GitHub issue mentions that a file upload could trigger this. I'm guessing that's because the time zone is included in the "date modified" field, but that's just a hunch. If anybody is able to quickly spin up a Ruby on Rails app with a file uploader, I bet somebody be happy to bang on it and see if they can get an exploit to trigger.…

[deleted]

Re: Arbitrary file execution in TZinfo (Ruby)

#10

Post by codedokode »

j16sdiz wrote: post #8

Is it really a bug in tzinfo? I think the bug is in the app that pass in user input as time zone

It is a bug in tzinfo. It should not execute random files when given invalid timezone identifier.

The app doesn't know what is a "valid" or "invalid" timezone, it is tzinfo's responsibility to check it.

UPD: in fact tzinfo tried to validate a timezone identifier but did it the wrong way. It used a regular expression like /^...$/ and using ^ and $ is a mistake here. This allows to bypass validation by passing a multiline identifier.

Post reply on HN