Executive brief
Reddit Terminal Viewer (RTV) is a terminal-based interface for browsing Reddit. The application fails to properly validate URLs before passing them to the web browser specified by the BROWSER environment variable, allowing attackers to inject arbitrary command-line arguments through crafted URLs. An attacker could exploit this to execute arbitrary commands on a user's system when the user clicks a malicious link.
Technical details
The vulnerability is an argument injection flaw (CWE-74) in the inspect_webbrowser.py script. The application constructs a command to launch the user's configured web browser but does not properly escape or validate the URL parameter before passing it as an argument, allowing an attacker to inject additional shell arguments. An attacker can craft a malicious URL that, when clicked within RTV, will execute arbitrary commands with the privileges of the user running RTV. This requires user interaction (clicking a link) but no authentication. The vulnerable versions span from 1.0a2 through 1.19.0. The repository was archived in February 2023 and is no longer maintained.
Affected products
- Michael Lazar Reddit Terminal Viewer up to 1.19.0
Timeline
- 2017-12: disclosed: CVE-2017-17516 published December 14, 2017
- 2022-05-14: advisory: GHSA-336h-q7mh-8vf8 published