xenstore.py xapi plugin uses potentially insecure shell=True

[Johannes Erdfelt]

This is a similar bug to LP726359.

plugins/xenserver/xenapi/etc/xapi.d/xenstore.py includes a function _run_command that uses Popen with shell=True. This can be potentially a security problem, especially considering it appears unescaped user data is used to construct the command to be executed.

[Johannes Erdfelt (johannes.erdfelt)]

Here is my first stab at a patch for the problem.

The code depends on using the shell in two ways:
1) It creates a space delimited string with all of the arguments
2) In one case it uses shell variables to get the status of a command

The patch changes the code to pass a list of arguments as well returning a status code for the command.

[Thierry Carrez (ttx)]

Thanks for reporting this issue ! Could you point to the user data that could be used unescaped in that command ? I couldn't find an obvious path. Setting to Medium importance, but ready to escalate to High/Critical if there is an exploitation path.

[Johannes Erdfelt (johannes.erdfelt)]

It depends on how the network info can be manipulated. The code to write vm-data/networking ends up writing JSON, but that won't correctly escape any apostrophes.

I'm not completely familiar with how things like DNS servers and other data get set, but that may or may not be a means to get user data through.

But if/when vm-data/hostname is set, that might provide a very easy way to exploit.

So while I'm not positive there is an exploit right now, it could be a time bomb waiting for a future feature to open an exploit.

[Thierry Carrez (ttx)]

I agree it should definitely be fixed before someone gets more creative than we do :)

[Johannes Erdfelt (johannes.erdfelt)]

Here's an updated version of the patch. It just cleans up some formatting.

[Johannes Erdfelt (johannes.erdfelt)]

Here's an updated version of the patch. It just cleans up some formatting.