CVE-2011-10007 – This vulnerability in File::Find::Rule Perl mod... (How to Fix)

📋 TL;DR

This vulnerability in File::Find::Rule Perl module allows arbitrary command execution when processing malicious filenames. Attackers can execute system commands by creating specially crafted filenames that get interpreted as shell commands. Any Perl application using File::Find::Rule's grep() function on untrusted file systems is affected.

💻 Affected Systems

Products:

File::Find::Rule Perl module

Versions: All versions through 0.34

Operating Systems: All operating systems running Perl

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects applications using the grep() method on untrusted file paths. The vulnerability requires attacker ability to create files in directories scanned by the application.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with root privileges if the vulnerable process runs with elevated permissions, allowing complete control over the affected system.

🟠

Likely Case

Arbitrary command execution with the privileges of the Perl process, potentially leading to data theft, privilege escalation, or lateral movement.

🟢

If Mitigated

Limited impact if the Perl process runs with minimal privileges and file system access is restricted to trusted directories.

🌐 Internet-Facing: MEDIUM - Risk exists if web applications process user-uploaded files using the vulnerable module, but requires specific conditions.

🏢 Internal Only: HIGH - Internal systems processing files from untrusted sources or shared directories are at significant risk.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires ability to create files in target directory. The provided example demonstrates successful command execution.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 0.34

Vendor Advisory: https://rt.cpan.org/Public/Bug/Display.html?id=64504

Restart Required: No

Instructions:

1. Update File::Find::Rule module using CPAN: 'cpan upgrade File::Find::Rule'
2. Verify installation: 'perl -MFile::Find::Rule -e "print $File::Find::Rule::VERSION"'
3. Ensure version is greater than 0.34

🔧 Temporary Workarounds

Input sanitization

all

Sanitize filenames before passing to File::Find::Rule grep() method

# Before calling grep(), validate filenames:
# my $safe_path = sanitize_path($user_input);
# File::Find::Rule->grep('pattern')->in($safe_path);

Use three-argument open

all

Modify the module source to use three-argument open() instead of two-argument

# Edit lib/File/Find/Rule.pm line ~423
# Change: open my $fh, $file
# To: open my $fh, '<', $file

🧯 If You Can't Patch

Restrict file system permissions to prevent untrusted users from creating files in scanned directories
Run Perl applications with minimal privileges and implement strict input validation for file paths

🔍 How to Verify

Check if Vulnerable:

Check if File::Find::Rule version is 0.34 or earlier and grep() method is used on untrusted paths

Check Version:

perl -MFile::Find::Rule -e 'print "Version: $File::Find::Rule::VERSION\n"'

Verify Fix Applied:

Test with the proof-of-concept example after patching - it should no longer execute commands

📡 Detection & Monitoring

Log Indicators:

Unusual process execution from Perl scripts
File operations on suspicious filenames containing pipe characters

Network Indicators:

Outbound connections from Perl processes that normally don't network

SIEM Query:

process.name: "perl" AND cmdline: "File::Find::Rule" AND cmdline: "grep"

📊 Metadata

CVE ID: CVE-2011-10007

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-78

EPSS Score: 0.06% exploit probability (20th percentile)

Published: June 5, 2025

Last Updated: June 6, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2011-10007, you might also want to check these: