Tcl Source Code

[UPDATED]
0-day vulnerability in tcl-exec (for win) by calling of batch-files resp. default windows command processor.

% exec my-echo.cmd {test &whoami} 
  "test &whoami"
% exec my-echo.cmd {test"&whoami} 
  test\"&whoami
% exec my-echo.cmd {test&whoami}
  test
  my_domain\sebres

Rather it is a matter the weird windows unescape behavior in case of command processor,
therefore almost everything else beside Tcl is affected by same vulnerability also similar way.

For example python (for win):

>>> subprocess.call(['my-echo.cmd', 'test &whoami'])
  "test &whoami"
>>> subprocess.call(['my-echo.cmd', 'test"&whoami'])
  test\"&whoami
>>> subprocess.call(['my-echo.cmd', 'test&whoami'])
  test
  my_domain\sebres

See github.com/sebres/PoC/SB-0D-001-win-exec for more extensive PoC with additional info (and more lang's).

Thanks to Peter (resuna) for link to discussion

It looks like the arguments containing unpaired quote-chars somewhere will cause processing of the special meta-characters, so it should be extra escaped using tripple circumflex but only for unpaired quote-chars (by paired quotes it remains the meta-char as well as ^^^ sequence).

For more extensive PoC I wrote a small helper dumping arguments (here test-dump.exe) as well as small batch (test-dump.cmd) doing the same:

@pushd %~dp0
@rem echo %*
@test-dump.exe %*
@popd

Instead of test-dump.exe one can use following code as test-dump.tcl (with adjusting the invocation in test-dump.cmd)

catch { puts -nonewline "    `[file tail $::argv0]´ `[join $::argv "´ `"]´"; flush stdout }

And use following tcl-script (test-dump-inv.tcl) to try or validate different variants (to find the "injuries"):

set testinv {test-dump.exe test-dump.CMD}

set tn 0
foreach a {
  {test"whoami}     {test""whoami}
  {test&whoami}     {test|whoami}
  {"test&whoami}    {"test|whoami}
  {test"&whoami}    {test"|whoami}
  {"test"&whoami}   {"test"|whoami}
  {""test"&whoami}  {""test"|whoami}
  {test&echo "}     {test|echo "}
  {"test&echo "}    {"test|echo "}
  {test"&echo "}    {test"|echo "}
  {"test"&echo "}   {"test"|echo "}
  {""test"&echo "}  {""test"|echo "}
  {test&echo ""}    {test|echo ""}
  {"test&echo ""}   {"test|echo ""}
  {test"&echo ""}   {test"|echo ""}
  {"test"&echo ""}  {"test"|echo ""}
  {""test"&echo ""} {""test"|echo ""}
  {test>whoami}     {test<whoami}
  {"test>whoami}    {"test<whoami}
  {test">whoami}    {test"<whoami}
  {"test">whoami}   {"test"<whoami}
  {""test">whoami}  {""test"<whoami}
  {test(whoami)}    {test(whoami)}
  {test"(whoami)}   {test"(whoami)}
  {test^whoami}     {test^^echo ^^^}
  {test"^whoami}    {test"^^echo ^^^}
} {
  puts [string repeat - 20]
  unset -nocomplain prevr
  foreach cmd $testinv {
    puts -nonewline [format "*%3d) `%s´" \
      $tn [join [list test-dump[file extension [lindex $cmd 0]] $a] "´ `"]]
    if {[catch {
      set r [exec {*}$cmd $a]
    } r]} {
      set r "ERROR: $r"
    }
    if {![info exists prevr] || $prevr eq $r} {
      puts ""
    } else {
      puts " -- *VULNERABLE*"
    }
    set prevr $r
    puts [regsub -all -line {^} $r "  "]
  }
  incr tn
}

The results:

> tclsh.exe test-dump-inv.tcl
--------------------
*  0) `test-dump.exe´ `test"whoami´
      `test-dump.exe´ `test"whoami´
*  0) `test-dump.CMD´ `test"whoami´
      `test-dump.exe´ `test"whoami´
--------------------
*  1) `test-dump.exe´ `test""whoami´
      `test-dump.exe´ `test""whoami´
*  1) `test-dump.CMD´ `test""whoami´
      `test-dump.exe´ `test""whoami´
--------------------
*  2) `test-dump.exe´ `test&whoami´
      `test-dump.exe´ `test&whoami´
*  2) `test-dump.CMD´ `test&whoami´ -- *VULNERABLE*
      `test-dump.exe´ `test´my_domain\sebres
--------------------
*  3) `test-dump.exe´ `test|whoami´
      `test-dump.exe´ `test|whoami´
*  3) `test-dump.CMD´ `test|whoami´ -- *VULNERABLE*
  my_domain\sebres
--------------------
*  4) `test-dump.exe´ `"test&whoami´
      `test-dump.exe´ `"test&whoami´
*  4) `test-dump.CMD´ `"test&whoami´
      `test-dump.exe´ `"test&whoami´
--------------------
*  5) `test-dump.exe´ `"test|whoami´
      `test-dump.exe´ `"test|whoami´
*  5) `test-dump.CMD´ `"test|whoami´
      `test-dump.exe´ `"test|whoami´
--------------------
*  6) `test-dump.exe´ `test"&whoami´
      `test-dump.exe´ `test"&whoami´
*  6) `test-dump.CMD´ `test"&whoami´
      `test-dump.exe´ `test"&whoami´
--------------------
*  7) `test-dump.exe´ `test"|whoami´
      `test-dump.exe´ `test"|whoami´
*  7) `test-dump.CMD´ `test"|whoami´
      `test-dump.exe´ `test"|whoami´
--------------------
*  8) `test-dump.exe´ `"test"&whoami´
      `test-dump.exe´ `"test"&whoami´
*  8) `test-dump.CMD´ `"test"&whoami´ -- *VULNERABLE*
      `test-dump.exe´ `"test"´my_domain\sebres
--------------------
*  9) `test-dump.exe´ `"test"|whoami´
      `test-dump.exe´ `"test"|whoami´
*  9) `test-dump.CMD´ `"test"|whoami´ -- *VULNERABLE*
  my_domain\sebres
--------------------
* 10) `test-dump.exe´ `""test"&whoami´
      `test-dump.exe´ `""test"&whoami´
* 10) `test-dump.CMD´ `""test"&whoami´
      `test-dump.exe´ `""test"&whoami´
--------------------
* 11) `test-dump.exe´ `""test"|whoami´
      `test-dump.exe´ `""test"|whoami´
* 11) `test-dump.CMD´ `""test"|whoami´
      `test-dump.exe´ `""test"|whoami´
--------------------
* 12) `test-dump.exe´ `test&echo "´
      `test-dump.exe´ `test&echo "´
* 12) `test-dump.CMD´ `test&echo "´
      `test-dump.exe´ `test&echo "´
--------------------
* 13) `test-dump.exe´ `test|echo "´
      `test-dump.exe´ `test|echo "´
* 13) `test-dump.CMD´ `test|echo "´
      `test-dump.exe´ `test|echo "´
--------------------
* 14) `test-dump.exe´ `"test&echo "´
      `test-dump.exe´ `"test&echo "´
* 14) `test-dump.CMD´ `"test&echo "´ -- *VULNERABLE*
      `test-dump.exe´ `"test´\""
--------------------
* 15) `test-dump.exe´ `"test|echo "´
      `test-dump.exe´ `"test|echo "´
* 15) `test-dump.CMD´ `"test|echo "´ -- *VULNERABLE*
  \""
--------------------
* 16) `test-dump.exe´ `test"&echo "´
      `test-dump.exe´ `test"&echo "´
* 16) `test-dump.CMD´ `test"&echo "´ -- *VULNERABLE*
      `test-dump.exe´ `test"´\""
--------------------
* 17) `test-dump.exe´ `test"|echo "´
      `test-dump.exe´ `test"|echo "´
* 17) `test-dump.CMD´ `test"|echo "´ -- *VULNERABLE*
  \""
--------------------
* 18) `test-dump.exe´ `"test"&echo "´
      `test-dump.exe´ `"test"&echo "´
* 18) `test-dump.CMD´ `"test"&echo "´
      `test-dump.exe´ `"test"&echo "´
--------------------
* 19) `test-dump.exe´ `"test"|echo "´
      `test-dump.exe´ `"test"|echo "´
* 19) `test-dump.CMD´ `"test"|echo "´
      `test-dump.exe´ `"test"|echo "´
--------------------
* 20) `test-dump.exe´ `""test"&echo "´
      `test-dump.exe´ `""test"&echo "´
* 20) `test-dump.CMD´ `""test"&echo "´ -- *VULNERABLE*
      `test-dump.exe´ `""test"´\""
--------------------
* 21) `test-dump.exe´ `""test"|echo "´
      `test-dump.exe´ `""test"|echo "´
* 21) `test-dump.CMD´ `""test"|echo "´ -- *VULNERABLE*
  \""
--------------------
* 22) `test-dump.exe´ `test&echo ""´
      `test-dump.exe´ `test&echo ""´
* 22) `test-dump.CMD´ `test&echo ""´
      `test-dump.exe´ `test&echo ""´
--------------------
* 23) `test-dump.exe´ `test|echo ""´
      `test-dump.exe´ `test|echo ""´
* 23) `test-dump.CMD´ `test|echo ""´
      `test-dump.exe´ `test|echo ""´
--------------------
* 24) `test-dump.exe´ `"test&echo ""´
      `test-dump.exe´ `"test&echo ""´
* 24) `test-dump.CMD´ `"test&echo ""´ -- *VULNERABLE*
      `test-dump.exe´ `"test´\"\""
--------------------
* 25) `test-dump.exe´ `"test|echo ""´
      `test-dump.exe´ `"test|echo ""´
* 25) `test-dump.CMD´ `"test|echo ""´ -- *VULNERABLE*
  \"\""
--------------------
* 26) `test-dump.exe´ `test"&echo ""´
      `test-dump.exe´ `test"&echo ""´
* 26) `test-dump.CMD´ `test"&echo ""´ -- *VULNERABLE*
      `test-dump.exe´ `test"´\"\""
--------------------
* 27) `test-dump.exe´ `test"|echo ""´
      `test-dump.exe´ `test"|echo ""´
* 27) `test-dump.CMD´ `test"|echo ""´ -- *VULNERABLE*
  \"\""
--------------------
* 28) `test-dump.exe´ `"test"&echo ""´
      `test-dump.exe´ `"test"&echo ""´
* 28) `test-dump.CMD´ `"test"&echo ""´
      `test-dump.exe´ `"test"&echo ""´
--------------------
* 29) `test-dump.exe´ `"test"|echo ""´
      `test-dump.exe´ `"test"|echo ""´
* 29) `test-dump.CMD´ `"test"|echo ""´
      `test-dump.exe´ `"test"|echo ""´
--------------------
* 30) `test-dump.exe´ `""test"&echo ""´
      `test-dump.exe´ `""test"&echo ""´
* 30) `test-dump.CMD´ `""test"&echo ""´ -- *VULNERABLE*
      `test-dump.exe´ `""test"´\"\""
--------------------
* 31) `test-dump.exe´ `""test"|echo ""´
      `test-dump.exe´ `""test"|echo ""´
* 31) `test-dump.CMD´ `""test"|echo ""´ -- *VULNERABLE*
  \"\""
--------------------
* 32) `test-dump.exe´ `test>whoami´
      `test-dump.exe´ `test>whoami´
* 32) `test-dump.CMD´ `test>whoami´ -- *VULNERABLE*

--------------------
* 33) `test-dump.exe´ `test<whoami´
      `test-dump.exe´ `test<whoami´
* 33) `test-dump.CMD´ `test<whoami´ -- *VULNERABLE*
      `test-dump.exe´ `test´
--------------------
* 34) `test-dump.exe´ `"test>whoami´
      `test-dump.exe´ `"test>whoami´
* 34) `test-dump.CMD´ `"test>whoami´
      `test-dump.exe´ `"test>whoami´
--------------------
* 35) `test-dump.exe´ `"test<whoami´
      `test-dump.exe´ `"test<whoami´
* 35) `test-dump.CMD´ `"test<whoami´
      `test-dump.exe´ `"test<whoami´
--------------------
* 36) `test-dump.exe´ `test">whoami´
      `test-dump.exe´ `test">whoami´
* 36) `test-dump.CMD´ `test">whoami´
      `test-dump.exe´ `test">whoami´
--------------------
* 37) `test-dump.exe´ `test"<whoami´
      `test-dump.exe´ `test"<whoami´
* 37) `test-dump.CMD´ `test"<whoami´
      `test-dump.exe´ `test"<whoami´
--------------------
* 38) `test-dump.exe´ `"test">whoami´
      `test-dump.exe´ `"test">whoami´
* 38) `test-dump.CMD´ `"test">whoami´ -- *VULNERABLE*

--------------------
* 39) `test-dump.exe´ `"test"<whoami´
      `test-dump.exe´ `"test"<whoami´
* 39) `test-dump.CMD´ `"test"<whoami´ -- *VULNERABLE*
      `test-dump.exe´ `"test"´
--------------------
* 40) `test-dump.exe´ `""test">whoami´
      `test-dump.exe´ `""test">whoami´
* 40) `test-dump.CMD´ `""test">whoami´
      `test-dump.exe´ `""test">whoami´
--------------------
* 41) `test-dump.exe´ `""test"<whoami´
      `test-dump.exe´ `""test"<whoami´
* 41) `test-dump.CMD´ `""test"<whoami´
      `test-dump.exe´ `""test"<whoami´
--------------------
* 42) `test-dump.exe´ `test(whoami)´
      `test-dump.exe´ `test(whoami)´
* 42) `test-dump.CMD´ `test(whoami)´
      `test-dump.exe´ `test(whoami)´
--------------------
* 43) `test-dump.exe´ `test(whoami)´
      `test-dump.exe´ `test(whoami)´
* 43) `test-dump.CMD´ `test(whoami)´
      `test-dump.exe´ `test(whoami)´
--------------------
* 44) `test-dump.exe´ `test"(whoami)´
      `test-dump.exe´ `test"(whoami)´
* 44) `test-dump.CMD´ `test"(whoami)´
      `test-dump.exe´ `test"(whoami)´
--------------------
* 45) `test-dump.exe´ `test"(whoami)´
      `test-dump.exe´ `test"(whoami)´
* 45) `test-dump.CMD´ `test"(whoami)´
      `test-dump.exe´ `test"(whoami)´
--------------------
* 46) `test-dump.exe´ `test^whoami´
      `test-dump.exe´ `test^whoami´
* 46) `test-dump.CMD´ `test^whoami´ -- *VULNERABLE*
      `test-dump.exe´ `testwhoami´
--------------------
* 47) `test-dump.exe´ `test^^echo ^^^´
      `test-dump.exe´ `test^^echo ^^^´
* 47) `test-dump.CMD´ `test^^echo ^^^´
      `test-dump.exe´ `test^^echo ^^^´
--------------------
* 48) `test-dump.exe´ `test"^whoami´
      `test-dump.exe´ `test"^whoami´
* 48) `test-dump.CMD´ `test"^whoami´
      `test-dump.exe´ `test"^whoami´
--------------------
* 49) `test-dump.exe´ `test"^^echo ^^^´
      `test-dump.exe´ `test"^^echo ^^^´
* 49) `test-dump.CMD´ `test"^^echo ^^^´ -- *VULNERABLE*
      `test-dump.exe´ `test"echo ´

The major injury is happened by pre-processing of the arguments with special meta-chars (so depends on quotes-count or position), but some tests show that Tcl seems to have here additionally insufficient escaping by some special characters (at least looks like vulnerable arguments-handling, also by execution of some tests without unpaired quotes (after escape).

Fixed in branch 0-day-21b0629c81.

Branch [fix-fb2fa9b3f6--percent-subst-regr] was merged with commit [ee7ec33deb]. Only the "%env%" part of ticket [ea3b6d6792] is reverted. The requirement was ticket [fb2fa9b3f6].

Open work for a general multi-mode exec is pending.

Thanks to Sergey !

Harald

Sergey, yes, I also think, we should only revert the special treatment of "%" by individual quoting.

The rest of the patch improves anyway already present quoting rules and fixes issues with them (double quoting).

Please just go on and merge it to 8.6.

Thank you and take care, Harald

I meant only revert the special %-escape (so basically merge branch "fix-fb2fa9b3f6--percent-subst-regr"). Because the rest of [21b0629c81] is fully justified in my opinion, as well as more or less backwards compatible (unless one doesn't try to simulate special "raw" invocation by inject into old escape handling in order to get some special command line).

But sure, I can do that, once I'd get the fossil to hand.

Regarding the documentation, one'd then only need to meant that %-chars are not (yet) specially escaped, so by execution of comspec/batch/cmd windows would replace %var% with environment variables, and this way to become safe it could expect special handling by parameter escape, because may become "vulnerable" against double/triple quotes in whole command line.

Dear Sergey, if you are the opinion, that this should be reverted, it would be great to do that soon. I think, this would be a good thing, as the usability for me is higher, than the vulnerability protection.

Could you just act and do the changes?

I may assist and adapt the documentation.

Thank you for your constant effort, great !

Take care, Harald

Documentation of the current state added in core-8-6-branch and up: [71dd06e857]

To control the quoting of exec is a purpose of a TIP which may come up soon.

Thanks, Sergey, for the help on the documentation, Harald

Also, recent discussion on this topic may be found in ticket [fb2fa9b3f6].

Take care, Harald

Thanks, great !

Proposed documentation for the introduced quoting in commit [7af4466e66] for review.

Review welcome ! Harald

So although now it is anyway better as it previously was, the story continues - the handling round about percent character is a bit complex:

% set ::env(X) "simple-X"; set ::env("X") "quoted-X"
% exec test-dump.cmd {%X%} {%"X"%} {"%X%"}
    `test-dump.exe´ `quoted-X´ `%"X"%´ `"quoted-X"´

_{Thanks to Eryk Sun (@eryksun) noticed this by the fix for python.}

So there are three possible scenarios:

1. either let it as is currently, so don't change something (the environment variable in quotes is very rare, but anyway it is a bit ugly as "good" solution);
2. or try to find better escape handling (I assume possible only if it will be escaped differently for invocation of exe and cmd).
3. if the "proper" escape of %-char will get state as really impossible or very complex (so can be defined as not a bug but "expected" feature), so let it be, but at least it belongs definitely into the documentation with some bold warning.

So I'm by 2 at the moment, WiP.

closed within merge [99af12fd19] and the following, for >= 8.5

Grrr... amend in [ae46c72447] should fix it now (+ extends test-cases).

Further tests are welcome.

Never ending story: found new cases that are still uncovered by current fix:
- `%` char to be escaped (quoted) in any case (regardless pairing flag), otherwise `%username%` will be interpolated as username.
- escape of multiple backslashes before quote is different (as without following quote) in unpaired quote syntax (upaired flag set).
- etc.

WiP.

Although this fixed the issue, at the same time it is a bit incompatible if wanted "raw" (not escaped) arguments,
for example by invocation of cmd /c ...something raw, because script...

Search for exec in own (as well as many open source) projects, shows me almost never the usage of "raw" arguments as expected case. In contrary, many invocation's of cmd /c expecting also that arguments are escaped properly.
Let alone real raw data were anyway impossible (because previously partially escaped also).

Therefore (and because this fixed a grave 0-day vulnerability), the default escape should take place as it is implemented in 0-day-21b0629c81.

But perhaps, just to provide the developer a possibility to invoke cmd /c with raw-unescaped scripts (e. g. something enclosed in 2x double-quoted block, like cmd /c ""...raw-script..."" etc.), I suggest to extend "exec" with new option "-raw".

exec -raw cmd /c ""...raw-script-dev-want-escape-independent...""

Fixed in branch 0-day-21b0629c81 (for 8.5).
I'll merge it soon (>= 8.5), if no objections follow.

Updated with many other test-cases (with better readability as single-line, etc.).
Additionally I noticed, that previously I had created the tests using already partially fixed tcl-library (so regenerated now).