It appears as if the power_system method exposed in the xmlrpc api is vulnerable to command injection through either the system handle(I am not sure about this one :-)) the provided password or the username.
The api.py code features the following:
def power_on(self, system, user=None, password=None, logger=None):
"""
Powers up a system that has power management configured.
"""
return action_power.PowerTool(self._config,system,self,user,password,logger=logger).power("on")
and in action_power.py the following code is found under the 'power' method
def power(self, desired_state):
...
template = self.get_command_template()
template_file = open(template, "r")
meta = utils.blender(self.api, False, self.system)
meta["power_mode"] = desired_state
# allow command line overrides of the username/password
if self.force_user is not None:
meta["power_user"] = self.force_user
if self.force_pass is not None:
meta["power_pass"] = self.force_pass
tmp = templar.Templar(self.api._config)
cmd = tmp.render(template_file, meta, None, self.system)
template_file.close()
cmd = cmd.strip()
...
# use shell so we can have mutliple power commands chained together
cmd = ['/bin/sh','-c', cmd]
# Try the power command 5 times before giving up.
# Some power switches are flakey
for x in range(0,5):
output, rc = utils.subprocess_sp(self.logger, cmd, shell=False)
see [0] for some of the source code in the utils.subprocess_sp method.
while the shell=False is passed (eventually) through to the subprocess.Popen method, as the shell /bin/sh[1] has been provided in front of the command passed in shell meta-characters will be actually be a problem. As far as I can tell the template cmd rendering will not strip out shell meta-characters and opens up a command injection attack vector.
[0] utils.subprocess_sp(found in utils.py) just does the following -->
def subprocess_sp(logger, cmd, shell=True):
if logger is not None:
logger.info("running: %s" % cmd)
try:
sp = sub_process.Popen(cmd, shell=shell, stdout=sub_process.PIPE, stderr=sub_process.PIPE, close_fds=True)
...
[1] To verify that this is the case you test it out -->
>>> import subprocess
>>> subprocess.Popen(["/bin/sh", "-c", "echo lol && /bin/sh"], shell=False)
<subprocess.Popen object at 0x7f0ecaa92b50>
>>> lol
sh-4.1$
Without hitting the xmlrpc directly(just using a local python test script) I was able to inject shell commands by providing the following user-name:
";my command goes here ;" (when the power_rsa.template file was the selected power template).