{"action":"opened","issue":{"url":"https://api.github.com/repos/axkibe/lsyncd/issues/348","labels_url":"https://api.github.com/repos/axkibe/lsyncd/issues/348/labels{/name}","comments_url":"https://api.github.com/repos/axkibe/lsyncd/issues/348/comments","events_url":"https://api.github.com/repos/axkibe/lsyncd/issues/348/events","html_url":"https://github.com/axkibe/lsyncd/issues/348","id":113596167,"number":348,"title":"direct mode allows injecting unauthorized filesystem operations","user":{"login":"wodny","id":882353,"avatar_url":"https://avatars.githubusercontent.com/u/882353?v=3","gravatar_id":"","url":"https://api.github.com/users/wodny","html_url":"https://github.com/wodny","followers_url":"https://api.github.com/users/wodny/followers","following_url":"https://api.github.com/users/wodny/following{/other_user}","gists_url":"https://api.github.com/users/wodny/gists{/gist_id}","starred_url":"https://api.github.com/users/wodny/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wodny/subscriptions","organizations_url":"https://api.github.com/users/wodny/orgs","repos_url":"https://api.github.com/users/wodny/repos","events_url":"https://api.github.com/users/wodny/events{/privacy}","received_events_url":"https://api.github.com/users/wodny/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-27T14:29:02Z","updated_at":"2015-10-27T14:29:02Z","closed_at":null,"body":"Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801263\r\nI looks like the bug hasn't been submitted upstream by the maintainer so I resubmit it here.\r\n\r\nIn the `default-direct.lua` file in the `event.etype == 'Move'` branch\r\ninstead of using a direct fork/exec a shell in spawned. Its arguments\r\naren't quoted so one can inject additional parameters using whitespace\r\ncharacters.\r\n\r\nlsyncd seems to require directory paths to be absolute to work correctly in daemon mode so at least\r\nother branches doing direct exec but not using '--' are probably safe. Still one might consider using dashes as well.\r\n\r\nExamples can be tested after entering the source directory.\r\n\r\nExample 1:\r\n```sh\r\n    $ touch ' '\r\n    $ mv ' ' sthelse\r\n```\r\nCauses rm -rf on target (the whole directory)\r\n\r\nExample 2:\r\n```sh\r\n    $ touch -- ' -t tmp'\r\n    $ mv ' -t tmp' ' sthelse'\r\n```\r\n\r\nMoves the target directory and its contents to `/tmp`. lsyncd's cwd is `/`."}}