{"action":"created","issue":{"url":"https://api.github.com/repos/johnkerl/miller/issues/111","repository_url":"https://api.github.com/repos/johnkerl/miller","labels_url":"https://api.github.com/repos/johnkerl/miller/issues/111/labels{/name}","comments_url":"https://api.github.com/repos/johnkerl/miller/issues/111/comments","events_url":"https://api.github.com/repos/johnkerl/miller/issues/111/events","html_url":"https://github.com/johnkerl/miller/issues/111","id":182370574,"number":111,"title":"[security] Shell command injection via filename when using --prepipe","user":{"login":"cym13","id":4958985,"avatar_url":"https://avatars.githubusercontent.com/u/4958985?v=3","gravatar_id":"","url":"https://api.github.com/users/cym13","html_url":"https://github.com/cym13","followers_url":"https://api.github.com/users/cym13/followers","following_url":"https://api.github.com/users/cym13/following{/other_user}","gists_url":"https://api.github.com/users/cym13/gists{/gist_id}","starred_url":"https://api.github.com/users/cym13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cym13/subscriptions","organizations_url":"https://api.github.com/users/cym13/orgs","repos_url":"https://api.github.com/users/cym13/repos","events_url":"https://api.github.com/users/cym13/events{/privacy}","received_events_url":"https://api.github.com/users/cym13/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/johnkerl/miller/labels/active","name":"active","color":"009800"},{"url":"https://api.github.com/repos/johnkerl/miller/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-10-11T20:49:42Z","updated_at":"2016-10-12T01:57:09Z","closed_at":null,"body":"What\r\n====\r\n\r\nUsing --prepipe to specify a preprocessing command is vulnerable to shell injection.\r\n\r\nProof of concept\r\n================\r\n\r\n    [cym13@Eather test]$ ls\r\n    [cym13@Eather test]$ mlr --from a\\;uname\\ -a\\;.csv --prepipe \"echo\" cat\r\n    sh: a: No such file or directory\r\n    1=Linux Eather 4.7.5-1-ARCH #1 SMP PREEMPT Sat Sep 24 13:04:22 CEST 2016 x86_64 GNU/Linux\r\n    sh: .csv: command not found\r\n\r\nWhile it is well understood that prepipe allows the user to run shell commands, the fact that the filename isn't properly quoted is clearly a bug.  All popen calls in miller are affected.\r\n\r\nHypothetical exploitation\r\n=========================\r\n\r\nMiller is a command-line tool which means it is likely to be integrated to scripts to deal with input automatically.\r\n\r\nLet's consider the case of a website getting csv formatted input from users that wants them to be able to send a zipped file (think some accounting software linked to a website to analyze its data).\r\n\r\nA malicious user could send a zip file with a specially crafted name like \"a;python3 -m http.server;b.csv.zip\" and send it, effectively executing remotely a python command launching a web server for further exploration.\r\n\r\nThis is a high-risk vulnerability that should be fixed ASAP.\r\n"},"comment":{"url":"https://api.github.com/repos/johnkerl/miller/issues/comments/253097903","html_url":"https://github.com/johnkerl/miller/issues/111#issuecomment-253097903","issue_url":"https://api.github.com/repos/johnkerl/miller/issues/111","id":253097903,"user":{"login":"johnkerl","id":2008794,"avatar_url":"https://avatars.githubusercontent.com/u/2008794?v=3","gravatar_id":"","url":"https://api.github.com/users/johnkerl","html_url":"https://github.com/johnkerl","followers_url":"https://api.github.com/users/johnkerl/followers","following_url":"https://api.github.com/users/johnkerl/following{/other_user}","gists_url":"https://api.github.com/users/johnkerl/gists{/gist_id}","starred_url":"https://api.github.com/users/johnkerl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johnkerl/subscriptions","organizations_url":"https://api.github.com/users/johnkerl/orgs","repos_url":"https://api.github.com/users/johnkerl/repos","events_url":"https://api.github.com/users/johnkerl/events{/privacy}","received_events_url":"https://api.github.com/users/johnkerl/received_events","type":"User","site_admin":false},"created_at":"2016-10-12T01:57:09Z","updated_at":"2016-10-12T01:57:09Z","body":"This also needs to escape single-quotes in the \"filename\", if present. This still gets through:\r\n\r\n```\r\nmlr --from \"a';uname -a;'.csv\" --prepipe \"echo\" cat\r\n```"}}
{"actor":{"display_login":"johnkerl"}}