Arbitrary Code Execution in IO::Compress Perl Module

Mitigation Strategies

To mitigate the vulnerability in IO::Compress versions before 2.220, you should upgrade IO::Compress to version 2.220 or later.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in IO::Compress versions before 2.220 for Perl. It allows an attacker to execute arbitrary code through the File::GlobMapper module by controlling the output glob string.

The function _parseOutputGlob() wraps the user-supplied output glob string in double quotes and stores it. Later, _getFiles() evaluates this stored string using Perl's eval function. If the output glob contains a literal double quote, it breaks out of the quoted context, allowing the attacker to inject and execute arbitrary Perl code.

This arbitrary Perl code runs with the same privileges as the calling process, potentially leading to serious security risks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution within the context of the affected application, which means an attacker can run any Perl code they choose with the same privileges as the application.

Potential impacts include unauthorized access, data manipulation, system compromise, and the ability to perform malicious actions such as installing malware or stealing sensitive information.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the execution of arbitrary Perl code via an attacker-controlled output glob in IO::Compress versions before 2.220. Detection would involve identifying usage of vulnerable IO::Compress versions and monitoring for suspicious eval executions triggered by crafted output glob strings.

To detect if your system is vulnerable, first check the installed version of IO::Compress in your Perl environment. You can do this by running the following command in a terminal or Perl environment:

• perl -MIO::Compress -e 'print $IO::Compress::VERSION, "\n"'

If the version is earlier than 2.220, your system is vulnerable and should be updated.

Additionally, to detect exploitation attempts, monitor logs or runtime behavior for eval executions involving output glob strings containing double quotes, which could indicate attempts to inject Perl code.

Useful 0 Not Useful 0