Описание
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 6.17-1 |
| esm-infra-legacy/trusty | released | 6.01-1ubuntu0.14.04~esm2 |
| esm-infra-legacy/xenial | released | 6.01-1ubuntu0.16.04~esm2 |
| esm-infra/bionic | released | 6.01-1ubuntu0.1+esm1 |
| esm-infra/focal | released | 6.06-1ubuntu0.1+esm1 |
| jammy | released | 6.13-1ubuntu0.2 |
| noble | released | 6.16-1ubuntu0.24.04.1 |
| questing | released | 6.16-1ubuntu0.25.10.1 |
| resolute | released | 6.16-1ubuntu0.26.04.1 |
| upstream | released | 6.17-1 |
Показывать по
Ссылки на источники
EPSS
9.1 Critical
CVSS3
Связанные уязвимости
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()
HTTP::Daemon versions before 6.17 for Perl allow OS command injection ...
EPSS
9.1 Critical
CVSS3