Shell Command Injection in places.py plugin of mate-menu package

[Bernd Dietzel]

Shell Comands can be executed because places.py of the Advanced Mate Menu uses the old commands.getoutput funktion.

/usr/lib/ubuntu-mate/mate-menu/plugins/places.py

###Line 182 :###
 config = ConfigObj(home + "/.config/user-dirs.dirs")
 tmpdesktopDir = config['XDG_DESKTOP_DIR']
 tmpdesktopDir = commands.getoutput("echo " + tmpdesktopDir)
############

if ~/.config/user-dirs.dirs contains something like this :

XDG_DESKTOP_DIR="$HOME/Schreibtisch;xterm"

xterm will be executed on next start.

--> Please use subprocess.Popen() , not commands.getoutput()

[Bernd Dietzel (l-ubuntuone1104)]

The same possible shell injection in the plugin "appliations.py" in the function "add_to_desktop" :

Line 1128:
tmpdesktopDir = commands.getoutput("echo " + tmpdesktopDir)

Line 1132 :
os.system("cp \"%s\" \"%s/\"" % (desktopEntry.desktopFile, desktopDir))

[Bernd Dietzel (l-ubuntuone1104)]

Exploid demo Video

https://www.youtube.com/watch?v=mLqQcCSyvEQ