Nextcloud · Report #226896
Nextcloud Server Remote Command Execution
Summary
While we appreciate the reporter's enthusiasm we'd like to note that the code is only called with hard-coded values and trusted input. Until now the reporter has failed to provide us with a proof of concept for this issue.
The fact that a function can take input and actually evaluates it is by itself not a security risk unless user input is passed to this function. Which we fail to see here looking at https://github.com/search?q=user%3Anextcloud+findBinaryPath&type=Code&utf8=%E2%9C%93
As the reporter claimed to have requested a CVE identifier for this issue (CVE-2017-6959) we have publicly disclosed this issue to dispute this CVE.
Update: The CVE has been rejected.
How it was found
Hy NextCloud Security Team i found a critical vulnerability (RCE) :
Nextcloud Server 11.0.2 is affected by a critical vulnerability, which gives to the attacker complete permission to run a system command.
The root cause is insufficient validation of arguments to the exec function.
Vulnerable Code (498 - 525) /lib/private/legacy/helper.php:
public static function findBinaryPath($program) { $memcache = \OC::$server->getMemCacheFactory()->create('findBinaryPath'); if ($memcache->hasKey($program)) { return $memcache->get($program); } $result = null; if (self::is_function_enabled('exec')) { $exeSniffer = new ExecutableFinder(); // Returns null if nothing is found $result = $exeSniffer->find($program); if (empty($result)) { $paths = getenv('PATH'); if (empty($paths)) { $paths = '/usr/local/bin /usr/bin /opt/bin /bin'; } else { $paths = str_replace(':',' ',getenv('PATH')); } $command = 'find ' . $paths . ' -name ' . escapeshellarg($program) . ' 2> /dev/null'; exec($command, $output, $returnCode); if (count($output) > 0) { $result = escapeshellcmd($output[0]); } } } // store the value for 5 minutes $memcache->set($program, $result, 300); return $result; }