Ruby gem fastreader-1.0.8 remote code exec 3/6/2013 if the url contains any ; characters code will be executed as the user. for example if fastreader is fed http://www.g;id;.com id will be executed. ./fastreader-1.0.8/lib/entry_controller.rb .strip only removes whitespace before and after the URL. 115 # open web browser 116 command = (ENV['FASTREADER_WEB'] || "open") + " {@current_entry.url.strip}" 117 `{command}` Larry W. Cashdollar @_larry0 http://vapid.dhs.org/advisories/fastreader-1.0.8-remote-exec.html
