Shell Code Injection in hsi backend

[Bernd Dietzel]

The "hsi" backend of duplicity is vulnerabe to code injections.

It uses os.popen3() with should be replaced with subprocess.Popen().

Thank you.

File :
-------
/usr/lib/python2.7/dist-packages/duplicity/backends/hsibackend.py

This is the function witch is vulnerable :
------------------------------------------------------------
    def _list(self):
        commandline = '%s "ls -l %s"' % (hsi_command, self.remote_dir)
        l = os.popen3(commandline)[2].readlines()[3:]

Exploit Demo :
============

On the Terminal type in :

$ duplicity 'hsi://bug/";xeyes;"/test/' /tmp/bug

--> This will start the program xeyes , but should not.

I attached a screenshot of the exploit demo.

ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: duplicity 0.7.02-1ubuntu1
ProcVersionSignature: Ubuntu 4.2.0-18.22-generic 4.2.3
Uname: Linux 4.2.0-18-generic x86_64
ApportVersion: 2.19.1-0ubuntu5
Architecture: amd64
CurrentDesktop: MATE
Date: Mon Nov 23 22:09:23 2015
InstallationDate: Installed on 2015-11-13 (9 days ago)
InstallationMedia: Ubuntu 15.10 "Wily Werewolf" - Release amd64 (20151021)
SourcePackage: duplicity
UpgradeStatus: No upgrade log present (probably fresh install)

[Marc Deslauriers (mdeslaur)]

Thanks for reporting this issue. Have you reported it to the duplicity developers?

If not, please report it to them in their bug tracker here:
https://bugs.launchpad.net/duplicity

and link the bug to this one.

Thanks!

[Bernd Dietzel (l-ubuntuone1104)]

Link
https://bugs.launchpad.net/duplicity/+bug/1520691

[Kenneth Loafman (kenneth-loafman)]

This bug was fixed in duplicity 0.7.07.

[Vej (vej)]

This is fixed upstream since duplicity 0.7.07 (https://launchpad.net/duplicity/0.7-series/0.7.07). Please consider this for a SRU.