Security hole in the Snoopy library

[mbonetti]

Whenever an SSL protected webpage is requested with one of the many Snoopy API calls, it calls the function _httpsrequest which takes the URL as argument. This function in turn calls the PHP-function exec with unchecked user-input. Using a specially crafted URL, an attacker can supply arbitrary commands that are executed on the web server with priviledges of the web user.

While the vulnerability can not be exploited using the Snoopy class file itself, there may exist implementations which hand unchecked URLs from users to snoopy.

Advisory

[sdcosta]

IMO, it looks like gregarius is not affected, since SJM's patch was applied to get https support. This was used instead of the official Snoopy sources.

We have the following line in source:trunk/rss/extlib/Snoopy.class.inc#latest

 var $use_curl           = false;

and this is never set to true, so _curlrequest and the exec command are never called.

This is implemented differently in version 1.20 of Snoopy.

This needs to be checked however. I could be completely wrong.

[sdcosta]

Sorry I was being silly as usual. However if your php is compiled with curl-https support (on dreamhost the default php is) then you are not affected.

[mbonetti]

Lets trust php's escapeshellcmd() and call this fixed as of [994]