CVE-2024-12970

CVE-2024-12970 describes an OS Command Injection vulnerability found in the My Computer software of the Pardus operating system. This vulnerability allows a user to inject system commands through the file name parameter, thus enabling an attacker to execute malicious commands on the system.

This vulnerability exists in versions of Pardus My Computer prior to version 0.7.2.

Vulnerable Function

The vulnerability exists in the get_file_info function. This function uses a subprocess call to retrieve disk information from the user. However, because the file path parameter (file) in this call is not properly validated, it leads to an OS Command Injection vulnerability through the disk name provided by the user. Function:

def get_file_info(file, network=False):
    if network:
        try:
            process = subprocess.check_output(f"df '{file}' --block-size=1000 -T | awk 'NR==1 {{next}} {{print $1,$2,$3,$4,$5,$7; exit}}'", shell=True, timeout=1)
        except subprocess.TimeoutExpired:
            print("timeout error on {}".format(file))
            return None

Vulnerable Parameter

The vulnerability relies on the file parameter being user-supplied and directly used in the subprocess.check_output() function. The user can provide their own disk name for the file parameter, and this disk name is used directly in shell commands. This allows the user to perform command injection.

Example vulnerable parameter line:

process = subprocess.check_output(f"df '{file}' --block-size=1000 -T | awk 'NR==1 {{next}} {{print $1,$2,$3,$4,$5,$7; exit}}'", shell=True)

Exploit

To exploit the vulnerability, an attacker can place a malicious payload in the name of the disk to be mounted as follows:

&' <çalıştırılmak istenen shell komutu> #

When a disk with this name is mounted via Pardus My Computer, the exploit executes.