Arbitrary command execution when converting images from a shared series

[dustenhubbard]

Problem

Opening a series someone else prepared, then running an image conversion, can execute arbitrary shell commands on macOS and Linux. The trigger is data in the .jser file, so a series shared by email, a lab drive, or a download is enough, and no warning is shown.

MainWindow builds the converter command by wrapping fields from the series in double quotes and running the result through a shell on non-Windows platforms:

convert_cmd = launch_prefix + [
    str(zarr_converter.absolute()),
    "convert_zarr",
    str(cores),
    f"\"{self.series.src_dir}\"",   # value comes straight from the .jser
    zarr_fp
]
...
convert_cmd = " ".join(convert_cmd)
subprocess.Popen(convert_cmd, shell=True, stdout=None, stderr=None)

self.series.src_dir is read verbatim from series_data["src_dir"]. Double quotes do not neutralize a shell: $(...), backticks, and a closing quote followed by ; or && are all interpreted. The neuroglancer export path has the same shape with self.series.jser_fp and the --output argument.

How it fires

1. A series is saved with src_dir set to, for example, /data/imgs$(<command>).
2. Someone opens that series and starts a zarr conversion or neuroglancer export, the ordinary next step for image data.
3. <command> runs with the user's privileges. The conversion still proceeds, so nothing looks wrong.

The mechanism reproduces with the exact launch code, substituting a harmless marker:

src_dir = '/tmp/imgs$(touch /tmp/proof)'
cmd = 'echo start_process.py convert_zarr 4 "' + src_dir + '"'
subprocess.Popen(cmd, shell=True).wait()
# /tmp/proof now exists

Scope

Both converter launch sites, convert_zarr and create_ng_zarr. macOS and Linux only; the Windows branch already passes an argv list and is not affected. Reachable from a stock install with no non-default settings.

Fix

Pass the command as an argv list on every platform, each path a single element, and drop shell=True and the manual quoting. PR follows.

Type:

Bug (security).