mintInstall possible code execution when Website contains Shell Commands

[Bernd Dietzel]

If the Website URL of a package contains shell commands, they possible could be injected and executed by os.system()

Package : mintInstall
Version : 7.6.0

File : /usr/lib/linuxmint/mintInstall/mintInstall.py
Line : 1045

os.system("xdg-open " + self.current_package.pkg.candidate.homepage + " &")

File : /usr/lib/linuxmint/mintInstall/frontend.py
Line : 418 ... 424

def visit_web(widget, model, username):
 if model.selected_application != None:
  os.system("sudo -u " + username + " /usr/lib/linuxmint/common/launch_browser_as.py \"" + model.selected_application.link + "\"")

def visit_website(widget, model, username):
 if model.selected_application != None:
  os.system("sudo -u " + username + " /usr/lib/linuxmint/common/launch_browser_as.py \"" + model.selected_application.website + "\"")

Please check for all os.system calls and replace them with subprocess.Popen()
Thank you :-)

[Bernd Dietzel (l-ubuntuone1104)]

By the way ... the file:
/usr/lib/linuxmint/mintInstall/remove.py

should be updatet , too.
it uses a funny mix of unsave and Deprecated python modules and a "Shell=True" for subprocess, wich is not necessary.

line 40 : ** unsave, allows shell injection **
os.system(command)

line 41: **Deprecated , allows shell injection **
commands.getoutput()

line 57: ** shell should be False , not True **
comnd = Popen(' '.join(cmd), shell=True)

Please update that.
Thanks :-)

[Bernd Dietzel (l-ubuntuone1104)]

Shell Commands execute when searching
github.com/linuxmint/mintinstall/issues/90