Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crmsh - shell injection in cmd status #1429

Closed
jirib opened this issue May 29, 2024 · 0 comments · Fixed by #1430
Closed

crmsh - shell injection in cmd status #1429

jirib opened this issue May 29, 2024 · 0 comments · Fixed by #1430
Assignees
@nicholasyang2022

Comments

@jirib
Copy link

jirib commented May 29, 2024 •
edited
Loading

  • 4.6.0-2 on Debian unstable

According to Nicholas Yang, it is "maybe some kinds of shell injection. The tailing arguments get appended to crm_mon -1 without being quoted and executed as a cmdline"; hence, I'm opening this bug.

crm(pe-input-1292/t14s)# status | head -n1
Cluster Summary:

crm(pe-input-1292/t14s)# configure show related:FS_gasxp01lv01_new | head -n1
ERROR: object | does not exist

crm(pe-error-57/t14s)# configure show related:FS_gasxp01lv01_new| head -n1
ERROR: object head does not exist

crm(pe-error-57/t14s)# configure show related:FS_gasxp01lv01_new |head -n1
ERROR: object |head does not exist
nicholasyang2022 added a commit to nicholasyang2022/crmsh that referenced this issue May 30, 2024
@nicholasyang2022
Fix: cmd_status: call crm_mon without shell (ClusterLabs#1429)
1fb36b5
@nicholasyang2022 nicholasyang2022 mentioned this issue May 30, 2024
Merged
@nicholasyang2022 nicholasyang2022 self-assigned this May 30, 2024
@nicholasyang2022 nicholasyang2022 changed the title crmsh - shell injection crmsh - shell injection in cmd status May 30, 2024
nicholasyang2022 added a commit to nicholasyang2022/crmsh that referenced this issue May 30, 2024
@nicholasyang2022
Fix: cmd_status: call crm_mon without shell (ClusterLabs#1429)
897116f
nicholasyang2022 added a commit to nicholasyang2022/crmsh that referenced this issue May 30, 2024
@nicholasyang2022
Fix: cmd_status: call crm_mon without shell (ClusterLabs#1429)
50877cb
nicholasyang2022 added a commit to nicholasyang2022/crmsh that referenced this issue May 30, 2024
@nicholasyang2022
Fix: cmd_status: call crm_mon without shell (ClusterLabs#1429)
c84bebd
liangxin1300 added a commit that referenced this issue May 31, 2024
@liangxin1300
Fix: cmd_status: call crm_mon without shell (#1429) (#1430)
c9a8378 
`crm status ...` appends tail arguments to the `crm_mon -1` without
quoting or escaping. This is unsafe as they will be parsed as a shell
command.

This patch changes how crmsh calls `crm_mon`. Arguments is passed as
string arrays instead of shell cmdline.

Fixes #1429.
liangxin1300 added a commit that referenced this issue May 31, 2024
@liangxin1300
[crmsh-4.6] Fix: cmd_status: call crm_mon without shell (#1429) (#1432)
d386cc4 
backport:

* #1430
liangxin1300 added a commit that referenced this issue May 31, 2024
@liangxin1300
[crmsh-4.5] Fix: cmd_status: call crm_mon without shell (#1429) (#1433)
f62a43e 
backport:

* #1430
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@nicholasyang2022 nicholasyang2022

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix: cmd_status: call crm_mon without shell (#1429) nicholasyang2022/crmsh
2 participants
@jirib @nicholasyang2022