{"action":"created","issue":{"url":"https://api.github.com/repos/Node-Virtualization/node-virtualbox/issues/29","repository_url":"https://api.github.com/repos/Node-Virtualization/node-virtualbox","labels_url":"https://api.github.com/repos/Node-Virtualization/node-virtualbox/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/Node-Virtualization/node-virtualbox/issues/29/comments","events_url":"https://api.github.com/repos/Node-Virtualization/node-virtualbox/issues/29/events","html_url":"https://github.com/Node-Virtualization/node-virtualbox/issues/29","id":161279279,"number":29,"title":"Potential for Arbitrary Command Injection","user":{"login":"jaredestroud","id":1250113,"avatar_url":"https://avatars.githubusercontent.com/u/1250113?v=3","gravatar_id":"","url":"https://api.github.com/users/jaredestroud","html_url":"https://github.com/jaredestroud","followers_url":"https://api.github.com/users/jaredestroud/followers","following_url":"https://api.github.com/users/jaredestroud/following{/other_user}","gists_url":"https://api.github.com/users/jaredestroud/gists{/gist_id}","starred_url":"https://api.github.com/users/jaredestroud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaredestroud/subscriptions","organizations_url":"https://api.github.com/users/jaredestroud/orgs","repos_url":"https://api.github.com/users/jaredestroud/repos","events_url":"https://api.github.com/users/jaredestroud/events{/privacy}","received_events_url":"https://api.github.com/users/jaredestroud/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Node-Virtualization/node-virtualbox/labels/Confirmed","name":"Confirmed","color":"009800"},{"url":"https://api.github.com/repos/Node-Virtualization/node-virtualbox/labels/Won't%20Fix","name":"Won't Fix","color":"e99695"}],"state":"open","locked":false,"assignee":{"login":"michaelsanford","id":1800499,"avatar_url":"https://avatars.githubusercontent.com/u/1800499?v=3","gravatar_id":"","url":"https://api.github.com/users/michaelsanford","html_url":"https://github.com/michaelsanford","followers_url":"https://api.github.com/users/michaelsanford/followers","following_url":"https://api.github.com/users/michaelsanford/following{/other_user}","gists_url":"https://api.github.com/users/michaelsanford/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelsanford/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelsanford/subscriptions","organizations_url":"https://api.github.com/users/michaelsanford/orgs","repos_url":"https://api.github.com/users/michaelsanford/repos","events_url":"https://api.github.com/users/michaelsanford/events{/privacy}","received_events_url":"https://api.github.com/users/michaelsanford/received_events","type":"User","site_admin":false},"assignees":[{"login":"michaelsanford","id":1800499,"avatar_url":"https://avatars.githubusercontent.com/u/1800499?v=3","gravatar_id":"","url":"https://api.github.com/users/michaelsanford","html_url":"https://github.com/michaelsanford","followers_url":"https://api.github.com/users/michaelsanford/followers","following_url":"https://api.github.com/users/michaelsanford/following{/other_user}","gists_url":"https://api.github.com/users/michaelsanford/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelsanford/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelsanford/subscriptions","organizations_url":"https://api.github.com/users/michaelsanford/orgs","repos_url":"https://api.github.com/users/michaelsanford/repos","events_url":"https://api.github.com/users/michaelsanford/events{/privacy}","received_events_url":"https://api.github.com/users/michaelsanford/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2016-06-20T19:53:23Z","updated_at":"2016-07-26T21:19:34Z","closed_at":null,"body":"the functions below in [virtualbox.js](https://github.com/Node-Virtualization/node-virtualbox/blob/master/lib/virtualbox.js), could allow for a user to inject additional commands with the cmd variable (ex: \"; pwd\") resulting in remote command execution assuming this was public facing.\r\n\r\n```\r\nfunction vboxcontrol(cmd, callback) {\r\n  command('VBoxControl ' + cmd, callback);\r\n}\r\n\r\nfunction vboxmanage(cmd, callback) {\r\n  command(vBoxManageBinary + cmd, callback);\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/Node-Virtualization/node-virtualbox/issues/comments/235408850","html_url":"https://github.com/Node-Virtualization/node-virtualbox/issues/29#issuecomment-235408850","issue_url":"https://api.github.com/repos/Node-Virtualization/node-virtualbox/issues/29","id":235408850,"user":{"login":"michaelsanford","id":1800499,"avatar_url":"https://avatars.githubusercontent.com/u/1800499?v=3","gravatar_id":"","url":"https://api.github.com/users/michaelsanford","html_url":"https://github.com/michaelsanford","followers_url":"https://api.github.com/users/michaelsanford/followers","following_url":"https://api.github.com/users/michaelsanford/following{/other_user}","gists_url":"https://api.github.com/users/michaelsanford/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelsanford/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelsanford/subscriptions","organizations_url":"https://api.github.com/users/michaelsanford/orgs","repos_url":"https://api.github.com/users/michaelsanford/repos","events_url":"https://api.github.com/users/michaelsanford/events{/privacy}","received_events_url":"https://api.github.com/users/michaelsanford/received_events","type":"User","site_admin":false},"created_at":"2016-07-26T21:19:34Z","updated_at":"2016-07-26T21:19:34Z","body":"Hi @jaredestroud !\r\n\r\nThis is certainly true. However, we never expected that these API would ever directly consume public, unfiltered input. As such, `node-virtualbox` affords no protection against it.\r\n\r\nIt shouldn't really be the responsibility of `node-virtualbox` to police input, because:\r\n\r\n1. We have _no idea_ what virtual environment might be running behind the API, and\r\n1. We have _no idea_ and _take no opinion_ about what the developer chooses to do with _their virtual environment:_ maybe someone actually does need to be able to run `sudo rm -rf /` for some reason.\r\n\r\nWe should therefore remain un-opinionated with regard to how the API is used.\r\n\r\nAt the very least, I could add a note in the README to underline this behaviour for those who may not be aware."}}
{"actor":{"display_login":"michaelsanford"}}