Are Perl backticks or the `system` command vulnerable to the BASH environment variable execution vulnerability?

minimim · 2 日前

It calls "/bin/sh". If this is provided by bash, yes. If you are in debian or other system where this isn't provided by bash, no.
http://perldoc.perl.org/perlop.html#qx/STRING/

linuxwhisperer · 2 日前

im not a big fan of using back ticks for exec; much rather explicitly pass arguments to system as an array, rather then hope arguments are interpreted correctly.

having said that, from perldoc -f system:

 system PROGRAM LIST
        Does exactly the same thing as "exec LIST", except that a fork is
        done first and the parent process waits for the child process to
        exit. Note that argument processing varies depending on the number
        of arguments. If there is more than one argument in LIST, or if
        LIST is an array with more than one value, starts the program
        given by the first element of the list with arguments given by the
        rest of the list. If there is only one scalar argument, the
        argument is checked for shell metacharacters, and if there are
        any, the entire argument is passed to the system's command shell
        for parsing (this is "/bin/sh -c" on Unix platforms, but varies on
        other platforms). If there are no shell metacharacters in the
        argument, it is split into words and passed directly to "execvp",
        which is more efficient.

confirming:

~$ perl -e 'system("pstree -cA");'
-xterm---bash---perl---pstree
~$ perl -e 'system("pstree -cA; ls -l /tmp/");'
-xterm---bash---perl---sh---pstree

so, on the surface: no, it is not vulnerable because its using /bin/sh and not /bin/bash

if your system /bin/sh is symlinked to /bin/bash.. you might be in for some pain.

i think it is good practice to wipe $ENV and set it explicitly before invoking system(), avoids any shenanigans Just In Case.

paul345 · 2 日前

It depends.

If it's a simple backtick/qr/system of a single command such as $now=date then perl just performs a clone/exec without bringing sh into the mix. Equally, $now=date -u is handled in the same way.

However, if the command being evaluated includes shell metacharacters like $ then perl passes everything via sh -c. For linux systems where /bin/sh mainly (always?) symlinks to /bin/bash, you're now in trouble.

Here's an example script with a safe and unsafe backtick:

#!/usr/bin/perl
$var=`/bin/echo bob`;
$var=`/bin/echo \$myvar`;

And here's strace proving where sh comes in:

strace -f ./tester.pl  2>&1|grep echo
ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
[pid 13597] execve("/bin/echo", ["/bin/echo", "bob"], [/* 18 vars */] <unfinished ...>
[pid 13598] execve("/bin/sh", ["sh", "-c", "/bin/echo $myvar"], [/* 18 vars */]) = 0
[pid 13598] execve("/bin/echo", ["/bin/echo"], [/* 17 vars */]) = 0

And given we're on centos in this exmaple, sh is really bash:

$ ls -l /bin/sh
lrwxrwxrwx. 1 root root 4 Sep 23 21:01 /bin/sh -> bash

(edit for more examples...)

Thinking more broadly in perl you have to look for any place where you're asking perl to evaluate something with shell metacharacters. The following deliberately bad code is vulnerable as perl will ask sh -c to evaluate the $myconfigfile line:

open(RES,"grep something \$myconfigfile|") or die;

wschroed · 2 日前

Had to come up with the right context... the issue is with the shell loading in the subprocess:

$ cat poc.pl
#!/usr/bin/env perl
use strict;
use warnings FATAL => 'all';

$ENV{x} = '() { :;}; echo vulnerable';
system("echo test one");
system("perl -e 'system(\"echo test two\")'");

$ perl poc.pl
test one
vulnerable
test two