Possible Shell Command Injection in daemon

[Bernd Dietzel]

File :
/usr/share/unity-scopes/gmusicbrowser/unity_gmusicbrowser_daemon.py

Function " do_activate" is vulnerable to Shell Commands in the filename of the tracks, the dirname of the album and the albumtracks.

os.system("xdg-open '%s'" % str(dirname))
##Example : xterm starts when dirname="/tmp/';xterm;#'.mp3"

same Problem here :
os.system('gmusicbrowser -play -playlist %s' % albumtracks)

So ...
Should not use os.system.
Should use subprocess.popen with the parameter Shell=False or should use quote().

Thank you.

ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: unity-scope-gmusicbrowser 0.1+13.10.20130723-0ubuntu1
ProcVersionSignature: Ubuntu 4.1.0-3.3-generic 4.1.3
Uname: Linux 4.1.0-3-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.18-0ubuntu5
Architecture: amd64
CurrentDesktop: Unity
Date: Sun Aug 9 20:29:56 2015
InstallationDate: Installed on 2015-08-09 (0 days ago)
InstallationMedia: Ubuntu 15.10 "Wily Werewolf" - Alpha amd64 (20150808)
PackageArchitecture: all
SourcePackage: unity-scope-gmusicbrowser
UpgradeStatus: No upgrade log present (probably fresh install)

[Bernd Dietzel (l-ubuntuone1104)]

Same issues in :
/usr/share/unity-scopes/audacious/unity_audacious_daemon.py
/usr/share/unity-scopes/guayadeque/unity_guayadeque_daemon.py
/usr/share/unity-scopes/clementine/unity_clementine_daemon.py
/usr/share/unity-scopes/musique/unity_musique_daemon.py

[Bernd Dietzel (l-ubuntuone1104)]

I attached a Clementine Scope Exploid Screenshot Demo

[Bernd Dietzel (l-ubuntuone1104)]

Exploid Demo Video (german)
https://www.youtube.com/watch?v=JrP7B6CIOMQ

[Seth Arnold (seth-arnold)]

Bernd, thank you for this report and excellent demonstrations. More to come later.

[Bernd Dietzel (l-ubuntuone1104)]

If the shell command can be injected seems only depend on how the Musikplayers store their data.

The Gmusicbrowser Unity Scope seems to be lucky because the gmusicbrowser player changes special chars in the name before it stores it in his database.

The Audacious Scope and Clementine Scope are not so lucky.

I attached a screenshot where you can see the differences.

[Seth Arnold (seth-arnold)]

All these tools used unsafe APIs and need drastic re-working regardless of specific database mitigations.

Thanks

[Bernd Dietzel (l-ubuntuone1104)]

I attached a patch for unity_clementine_daemon.py wich should solve the problem using subprocess

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "unity_clementine_daemon_patch.diff" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Bernd Dietzel (l-ubuntuone1104)]

Better patch attached for the clementine unity scope Python script.

1) I use subprocess.Popen() this time instead of the simple subprocess.call() before.
2) Should now handle albumtracks in a better way because its a list of strings.
3) Clementime gives you now a error message on playing a file when shell commands are in the filename.
4) A Folder Path with Shell Commands in the pathname will not be injected and not opened.

... could someone check it please ?

[Bernd Dietzel (l-ubuntuone1104)]

@David
Did you noticed that the albumtracks are a list and not a simple string ?
Have a look on my "Better patch for unity_clementine_daemon.py" on comment #10

[Seth Arnold (seth-arnold)]

The clementine patch appears to address the shell injection but does not address UTF-8 crashes nor SQL injections.

The gourmet patch appears to address the SQL injection but does not address the predictable /tmp/ filenames, potential cross-site scripting issues due to use of unquoted HTML, and the preview's localisation is still broken.

The audacious patch appears to address the shell injection -- but Bernd points out that it may not function if multiple tracks are selected -- and does not address the 'database' file descriptor leak.

The gmusicbrowser patch appears to address the shell injection -- but Bernd points out that it may not function if multiple tracks are selected -- and does not address the 'filename' file descriptor leak.

The musique patch appears to address both the shell injection and SQL injection issues. It does not address UTF-8 crashes.

The guayadeque patch appears to address the shell injection and SQL injections -- but Bernd points out that it may not function if multiple tracks are selected. It does not address UTF-8 crashes.

Thanks

[Bernd Dietzel (l-ubuntuone1104)]

My new Clementine Patch.
I had a look on the other patches to fix the SQL injections.
Fixed utf8 decoding to crash with try and except.
Hope it works. Please test.

[Bernd Dietzel (l-ubuntuone1104)]

@David
shotwell , firefoxbookmarks, chromiumbookmarks and zotero scope may be checked for sql injections, too.

Example : Some code of the shotwell scope :
sql='select * from PhotoTable where filename = \"'+filename+'\"'

[Bernd Dietzel (l-ubuntuone1104)]

For a Shotwell Scope SQL injection Demo , i attached a screenshot.
Code can be injected with a file name in the function getPhotoForUri.

Demonstration:
a) rename some picture like this

xx " UNION SELECT 1,'2','Hello','World',5,6,7,8,9,10,11,12,'13','14','15',16,17,18,19,20,21,22,23,24,'25',26,27,28,29 -- ".png

b) start shotwell and ensure the picture gets into the shotwell database
c) close shotwell
d) Search for xx in the Unity Dash and click on the picture
e) Have look at the picture dimensions and the size. It reads "Hello x World Pixels", size : 5.0b.
     This is only a harmles demo. Other things may happen like crashes or code execution.

[Tyler Hicks (tyhicks)]

Hi David - Can you take a look at Seth's feedback in comment 17 and then update your patches accordingly? Thanks!

[Bernd Dietzel (l-ubuntuone1104)]

New patch for unity_audacious_daemon.py
with better handling of multiple tracks

[Bernd Dietzel (l-ubuntuone1104)]

@Seth , you Comment 17 :

I had a look on audacious the db-file access :

    for collection in os.listdir(AUDACIOUS_DBFILE):
        dbfile = '%s/%s' % (AUDACIOUS_DBFILE, collection)
        database = open(dbfile, "r")
        database = database.read()
        if not database.startswith("title:Library"):
            records = database[14:]
            records = records.split("uri=")
        else:
            records = ""

What i can see are some bugs like this :

1) On my PC, the Database entry is not english "title:Library", but in my language "title=Sammlung" , notice it is written with "=" not with ":"
2) So "records = database[14:]" should be somewhat like "records = database[5:]"
3) There is no filter to use files with ".audpl" extension only.
4) There is a "//" in the dbfile Path

is it that what you mean ?

[Seth Arnold (seth-arnold)]

Bernd, all those look like different errors. I just meant that the line: "database = open(dbfile, "r")" doesn't have a corresponding line to close the file once it's done.

[Bernd Dietzel (l-ubuntuone1104)]

OK, check this new patch for the audacious scope.
- No injections
- Multiple Tracks
- Database issues

[Seth Arnold (seth-arnold)]

I haven't tested it but the patch looks like a vast improvement.

Thanks