Re: Security vulnerability in htags

--000000000000f2701f0617ec78ac
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,
I confirmed the security vulnerability and fixed it.
The result of executing the modified command is as follows:

$ rm -f /tmp/w
$ htags --suggest2 -d '&& id'
gtags: directory '/tmp/global/htags/&& id' not found.
htags: cannot execute gtags(1) command.
$ cat /tmp/w
cat: /tmp/w: No such file or directory
$ htags --suggest2 -d '$(pwd>/tmp/w)'
gtags: directory '/tmp/global/htags/$(pwd>' not found.
htags: cannot execute gtags(1) command.
$ cat /tmp/w
cat: /tmp/w: No such file or directory

I have attached the patch to this mail.
Thank you for the report.

Regards,
Shigio

On Wed, May 8, 2024 at 6:10=E2=80=AFAM u32i <[email protected]> wrote:
>
> Hi,
>
> I found a security vulnerability in htags. htags takes the input provided=
 in the dbpath option (-d) and appends it to a command string that will lat=
er be executed by system() function, without any escaping, leading to a com=
mand injection vulnerability.
>
> Vulnerable code: src/htags/htags.c:L1336
>
> Reproduce:
>
> Run htags by injecting a command in the dbpath argument (-d) :
>
>      $ htags --suggest2 -d '&& id'
>      // SNIP
>       uid=3D1000(user1) gid=3D1000(user1) groups=3D1000(user1),24(cdrom),=
25(floppy),27(sudo)
>       htags: GPATH, GTAGS and/or GRTAGS not found. Please reexecute htags=
 with the -g option.
>
>            $ htags --suggest2 -d '$(pwd>/tmp/w)'
>      $ cat /tmp/w
>      /home/user1/tests
>
> Environment:
>
> Tested in Debian 12, htags version 6.6.12
>
> Mitigation:
>
> Options added to or used in system commands should be validated and escap=
ed before used.
>
> Best Regards
>


--=20
Shigio YAMAGUCHI <[email protected]>
PGP fingerprint:
26F6 31B4 3D62 4A92 7E6F  1C33 969C 3BE3 89DD A6EB

--000000000000f2701f0617ec78ac
Content-Type: application/octet-stream; name="htags.diff"
Content-Disposition: attachment; filename="htags.diff"
Content-Transfer-Encoding: base64
Content-ID: <f_lvxic3h40>
X-Attachment-Id: f_lvxic3h40

SW5kZXg6IGh0YWdzLmMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PQpSQ1MgZmlsZTogL3NvdXJjZXMvZ2xvYmFsL2dsb2Jh
bC9odGFncy9odGFncy5jLHYKcmV0cmlldmluZyByZXZpc2lvbiAxLjIzNQpkaWZmIC1jIC1yMS4y
MzUgaHRhZ3MuYwoqKiogaHRhZ3MuYwkyIE1hciAyMDIwIDAwOjUzOjQ5IC0wMDAwCTEuMjM1Ci0t
LSBodGFncy5jCTggTWF5IDIwMjQgMDc6MzY6MDEgLTAwMDAKKioqKioqKioqKioqKioqCioqKiA0
Nyw1MiAqKioqCi0tLSA0Nyw1MyAtLS0tCiAgI2luY2x1ZGUgImFuY2hvci5oIgogICNpbmNsdWRl
ICJjYWNoZS5oIgogICNpbmNsdWRlICJjb21tb24uaCIKKyAjaW5jbHVkZSAiY2hhci5oIgogICNp
bmNsdWRlICJodGFncy5oIgogICNpbmNsdWRlICJpbmNvcC5oIgogICNpbmNsdWRlICJwYXRoMnVy
bC5oIgoqKioqKioqKioqKioqKioKKioqIDEzMzMsMTMzOSAqKioqCiAgCQkqLwogIAkJaWYgKGFy
Z19kYnBhdGhbMF0pIHsKICAJCQlzdHJidWZfcHV0YyhzYiwgJyAnKTsKISAJCQlzdHJidWZfcHV0
cyhzYiwgYXJnX2RicGF0aCk7CiAgCQl9CiAgCQlpZiAoc3lzdGVtKHN0cmJ1Zl92YWx1ZShzYikp
KQogIAkJCWRpZSgiY2Fubm90IGV4ZWN1dGUgZ3RhZ3MoMSkgY29tbWFuZC4iKTsKLS0tIDEzMzQs
MTM0MCAtLS0tCiAgCQkqLwogIAkJaWYgKGFyZ19kYnBhdGhbMF0pIHsKICAJCQlzdHJidWZfcHV0
YyhzYiwgJyAnKTsKISAJCQlzdHJidWZfcHV0cyhzYiwgcXVvdGVfc2hlbGwoYXJnX2RicGF0aCkp
OwogIAkJfQogIAkJaWYgKHN5c3RlbShzdHJidWZfdmFsdWUoc2IpKSkKICAJCQlkaWUoImNhbm5v
dCBleGVjdXRlIGd0YWdzKDEpIGNvbW1hbmQuIik7Cg==
--000000000000f2701f0617ec78ac--