Blind Command Injection #1

Summary

OS Command injection on text-to-speech functionality API.

This issue arised because of the generic text to speech conversion tool being used here in the web application & because of the fact that the user input data was not being sanitised before taking it to the server for output of the inputed data.

According to the issue, it was observed that espeak a Ubuntu command line tool was being used at the backend, because of which it was quite generic to just use simple command injection payloads, like

User Input:

hey `whoami`

At the backend: 

user1@ubuntu: espeak hey `whoami`

On the frontend:

output: hey user1

Because of this, it allowed a full access to the backend server which was running the command.

Use of the speakers here was quite important as you could hear the output of the command injection through you speakers, which turned out to be pretty cool! :D

Thanks to 8x8 team for fixing and validating this issue.