caja folder-color.py -> Shell Injection with icon theme

[Bernd Dietzel]

OS: UbuntuMATE 15.10
File : /usr/share/caja-python/extensions/folder-color.py
Version : Folder Color 0.0.78

By changing the folder color, shell code can be injected by a icon theme.
The python script uses os.system.

Line : 783
        # MATE
        os.system('gsettings set org.mate.interface icon-theme "%s"' % theme)

Exploit Example :
1) Copy some icon theme into the user .icons folder and rename it to this name :

/home/<user>/.icons/The `xeyes` icon theme/

2) Edit this file : index.theme

[Icon Theme]
Name=The `xeyes` icon theme

3) Use the icon theme

4) Run caja and then rigthclick onto a folder and change his color to the GLOBAL color blue.

5) The program xeyes starts several times as a proof of concept

-------

The mint team seems to have a bugfixed Version :
https://github.com/linuxmint/folder-color-switcher/blob/master/caja-extensions/caja-folder-color-switcher.py

[Bernd Dietzel (l-ubuntuone1104)]

Demo Video (german)
https://youtu.be/3IP8dh7NCpw

[costales (costales)]

Hi Bernd! !o/ Your hacking is awesome! :)

Could you overwrite this file:
/usr/share/caja-python/extensions/folder-color.py
with the attachment 'folder-color.py'?

And then:
caja -q
caja

And check if all is working as it should be now? :)

Thanks a lot mate!

[Bernd Dietzel (l-ubuntuone1104)]

Hi costales,
OK , works, no injections any more :-)

Maybe you like to call _run_cmd() in _reload_icon() and set_emblem() ,too ?
So you have only one function in the code which cares about the subprocess calls.

Thank you, too ;-)
Bernd

[costales (costales)]

Great :) Thanks a lot for the test |o/

I'll wait until tomorrow for the translations and I'll release it.

_run_cmd() is in another class, I'll leave like that, it is not a big deal :)

A really big hug and thanks again Bernd ;)

[costales (costales)]

Uploaded and sent to Bhavani for upload