RubySec

Providing security resources for the Ruby community

CVE-2014-9489 (gollum-grit_adapter): gollum-grit_adapter Search Functionality Allows Arbitrary Command Execution

ADVISORIES

GEM

gollum-grit_adapter

PATCHED VERSIONS

  • >= 0.1.1

DESCRIPTION

The gollum-grit_adapter gem contains a flaw that can allow arbitrary command execution.

Grit implements its search functionality by shelling out to git grep. In turn, git grep takes a -O or --open-files-in-pages option that will pipe the results of grep to an arbitrary process. By failing to properly sanitize user input search parameters, an attacker can thus perform command execution.

Note that the grep result must find the string ‘master’ (or whatever is the default branch that gollum uses) in any of the wiki’s documents for this to succeed.