Command injection in discordrb

Vulnerability

Overview

The discordrb library, an implementation of the Discord API in Ruby, contains a command injection vulnerability in its encoder.rb file. The encode_file method constructs a shell command string by directly interpolating the file parameter into a string that is passed to IO.popen [4]. This unsafe string construction allows an attacker to inject arbitrary shell commands if they can control the file argument passed to the vulnerable method [1][2]. The root cause is the lack of proper sanitization or use of an array-based command execution approach, which would prevent injection [4].

Exploitation

Conditions

This vulnerability is not directly exploitable by default; it requires that a client application call the encode_file method with untrusted user input [2]. If user-controlled data reaches the file parameter, an attacker can craft input such as backtick-enclosed commands or other shell metacharacters to achieve injection [4]. A proof of concept demonstrates that passing a string like \touch pwned\`` results in execution of the injected command [4]. The attack surface thus depends on how the library is used in downstream applications.

Impact

Successful exploitation allows an attacker to execute arbitrary shell commands on the host machine running the discordrb process [2]. The full impact is constrained by the permissions of the running process; it is unlikely to result in total system compromise unless the process runs with elevated privileges [2]. Nevertheless, remote code execution (RCE) is achievable, enabling actions like file manipulation, data exfiltration, or further lateral movement within the compromised environment [4].

Mitigation

Status

The issue has been addressed in code via commit 91e13043ffa, but as of the publication date, no new release of the discordrb gem has been published to rubygems [2][4]. Users are advised to apply the patch manually from the repository or to avoid passing untrusted input to the encode_file method until an updated gem is available [3]. The vulnerability is tracked as GHSL-2022-094 and is listed in the GitHub Security Lab advisories [1][4].