Описание
Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle.
Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. The helper is the open path behind the documented -file argument: new(-file => $thing) reaches it through ReadConfig. An in-memory scalar reference (-file => $text) does not open a path and is unaffected.
Any caller that forwards untrusted input to the -file argument can run an arbitrary command or truncate a file under the process UID.
A flaw was found in Config::IniFiles. This vulnerability allows an attacker to achieve OS command injection or overwrite files. By supplying untrusted input to the -file argument, an attacker can execute arbitrary commands or truncate files under the privileges of the application. This occurs because the _make_filehandle function misinterprets specially crafted filenames as system commands or file redirection operations.
Отчет
No Red Hat product ships an exploitable instance of Config::IniFiles. The matching RPM (perl-Config-IniFiles) is present only in the optional, disabled-by-default CodeReady Linux Builder (CRB) repositories for RHEL 8 and RHEL 9 as a build-time dependency, and is never invoked with attacker-controlled -file input by Red Hat's build process. The EPEL package already ships the fixed version (3.001000). Only the Fedora package remains on a pre-fix version; that is delegated to Fedora's own security response.
Меры по смягчению последствий
Users on Fedora (or any pre-fix build) should avoid passing untrusted input to Config::IniFiles->new(-file => ...). Passing an in-memory scalar reference instead (-file => $text) does not invoke the vulnerable code path and is unaffected. Upgrade to Config::IniFiles 3.001000+ once available.
Дополнительная информация
Статус:
EPSS
8.6 High
CVSS3
Связанные уязвимости
Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. The helper is the open path behind the documented -file argument: new(-file => $thing) reaches it through ReadConfig. An in-memory scalar reference (-file => \$text) does not open a path and is unaffected. Any caller that forwards untrusted input to the -file argument can run an arbitrary command or truncate a file under the process UID.
Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. The helper is the open path behind the documented -file argument: new(-file => $thing) reaches it through ReadConfig. An in-memory scalar reference (-file => \$text) does not open a path and is unaffected. Any caller that forwards untrusted input to the -file argument can run an arbitrary command or truncate a file under the process UID.
Config::IniFiles versions before 3.001000 for Perl allow OS command in ...
EPSS
8.6 High
CVSS3