{"action":"opened","issue":{"url":"https://api.github.com/repos/GGLucas/cortex/issues/33","repository_url":"https://api.github.com/repos/GGLucas/cortex","labels_url":"https://api.github.com/repos/GGLucas/cortex/issues/33/labels{/name}","comments_url":"https://api.github.com/repos/GGLucas/cortex/issues/33/comments","events_url":"https://api.github.com/repos/GGLucas/cortex/issues/33/events","html_url":"https://github.com/GGLucas/cortex/issues/33","id":172775520,"number":33,"title":"[SECURITY] Remote code execution when given malicious urls","user":{"login":"cym13","id":4958985,"avatar_url":"https://avatars.githubusercontent.com/u/4958985?v=3","gravatar_id":"","url":"https://api.github.com/users/cym13","html_url":"https://github.com/cym13","followers_url":"https://api.github.com/users/cym13/followers","following_url":"https://api.github.com/users/cym13/following{/other_user}","gists_url":"https://api.github.com/users/cym13/gists{/gist_id}","starred_url":"https://api.github.com/users/cym13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cym13/subscriptions","organizations_url":"https://api.github.com/users/cym13/orgs","repos_url":"https://api.github.com/users/cym13/repos","events_url":"https://api.github.com/users/cym13/events{/privacy}","received_events_url":"https://api.github.com/users/cym13/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-23T18:43:08Z","updated_at":"2016-08-23T18:43:08Z","closed_at":null,"body":"# What happens\r\n\r\nWhen openning an url such as **http://test.com/;sh;** the shell command is executed instead of openning the url. This allows a malicious attacker to execute code remotely on a large number of clients by providing such a malicious url on a popular subreddit.\r\n\r\nThis puts every user in danger and should be fixed swiftly.\r\n\r\n# Why it happens\r\n\r\nThe **browseropen** function uses call() with shell=True and a command line that is unsafely built and doesn't escape its elements. This allows the shell injection by using ; to indicate that another command must be executed.\r\n\r\n# How to fix it\r\n\r\nDo not use shell=True and use run() or Popen() instead of call().\r\n\r\n# Why I choose to disclose this publicly\r\n\r\nCortex hasn't been updated for a long time now. I feel important to put some pressure behind this issue as well as warning potential new users."}}
{"actor":{"display_login":"cym13"}}