Ruby Gem ldoce version 0.0.2 suffers from a command execution vulnerability.
e0a0c481b47cda56119e30048f9a0ff4309520aaeab8de2c5a98a5ae1b099cd8
Remote command execution in Ruby Gem ldoce 0.0.2
Larry W. Cashdollar
@_larry0
3/25/2013
Ldoce Ruby Gem:
Easily interface with the Longman Dictionary of Contemporary English API from Ruby:
NB currently mac only as it depends on the afplay command.
https://github.com/markburns/ldoce
Ldoce passes an mp3 url to commandline for audio output of the pronunciation of a dictonary word:
If the URL or filename for the mp3 files contain shell metacharacters code can be executed remotely as the client:
[./ldoce-0.0.2/lib/ldoce/word.rb]
if mp3?
unless File.exists? filename
command = "curl #{mp3_url} -silent > {filename}"
`{command}`
end
`afplay #{filename}`
end