NetBSD Problem Report #60941

From www@netbsd.org  Fri Oct 30 00:24:28 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id E60E21A923B
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 30 Oct 2026 00:24:27 +0000 (UTC)
Message-Id: <20261030002426.E53601A923C@mollari.NetBSD.org>
Date: Fri, 30 Oct 2026 00:24:26 +0000 (UTC)
From: kilian.feess@posteo.de
Reply-To: kilian.feess@posteo.de
To: gnats-bugs@NetBSD.org
Subject: atto: shell command injection by malicious file name on tab complete
X-Send-Pr-Version: www-1.0
X-From4GNATS: "kilian.feess@posteo.de via gnats" <gnats-admin@NetBSD.org>

>Number:         60941
>Category:       bin
>Synopsis:       atto: shell command injection by malicious file name on tab complete
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 30 00:25:00 +0000 2026
>Originator:     Kilian Feess
>Release:        NetBSD-current (11.99.9), src/usr.bin/atto as of 2026-10-30
>Organization:
>Environment:
Linux CelsiusM770 7.0.0-42-generic #42-Ubuntu SMP PREEMPT_DYNAMIC Thu Oct 15 08:06:44 UTC 2026 x86_64 GNU/Linux

>Description:
Pressing tab at any file prompt abuses the shell to auto complete

complete.c:52
strcpy(sys_command, "echo ");
strcat(sys_command, buf);          /* your prompt text, unquoted, unescaped */
if (!iswild) strcat(sys_command, "*");
strcat(sys_command, " >");
strcat(sys_command, temp_file);
strcat(sys_command, " 2>&1");
(void) system(sys_command);

Basically the trick is to use $ echo <pattern>* > tempfile
for tab completion

If a malicious filename is placed that contains shell commands it can execute under the current implementation of tab complete.

This issue exists in upstream as well https://github.com/hughbarney/atto

I used the GLM 5.3 LLM to find this bug.
>How-To-Repeat:
attacker plants a file

touch 'x;id>pwned;#'

C-x C-f to find a file, type x, press Tab, press any non-tab char(*), press Tab (injected prompt executes now)

(*) this can be an arrow key alphanumeric, anything but Tab, to reset didtry to 0


>Fix:
use glob.h

Home	PR Database Search