Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FIX] security: OS Command Injection vulnerability (x2) #1219 #1227

Merged
merged 7 commits into from
Apr 18, 2024
Merged

[FIX] security: OS Command Injection vulnerability (x2) #1219 #1227

Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bd75d16
[FIX] security: OS Command Injection vulnerability (x2) #1219
0xtejas Apr 8, 2024
825dad0
Update web/reNgine/common_func.py
0xtejas Apr 16, 2024
632d44a
Fix #1219 use inbuilt run_command instead of os.system causing RCE
yogeshojha Apr 17, 2024
8fb5c41
Add function to remove ansi color coding for regex
yogeshojha Apr 17, 2024
e003a91
added remove ansi sequence param in run command to remove ansi chars …
yogeshojha Apr 17, 2024
81c9264
remove results directory after parsing
yogeshojha Apr 17, 2024
10c5630
remove debug print
yogeshojha Apr 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions web/reNgine/common_func.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
import requests
import tldextract
import xmltodict
import subprocess

from bs4 import BeautifulSoup
from urllib.parse import urlparse
Expand Down Expand Up @@ -510,8 +511,8 @@ def get_cms_details(url):
"""
# this function will fetch cms details using cms_detector
response = {}
cms_detector_command = f'python3 /usr/src/github/CMSeeK/cmseek.py --random-agent --batch --follow-redirect -u {url}'
os.system(cms_detector_command)
cms_detector_command = ['python3', '/usr/src/github/CMSeeK/cmseek.py', '--random-agent', '--batch', '--follow-redirect', '-u', url]
subprocess.run(cms_detector_command)

response['status'] = False
response['message'] = 'Could not detect CMS!'
Expand Down