Security Flaw Discovered in GNOME File Manager’s Thumbnail Handler
A significant security vulnerability has been revealed in the thumbnail handler of the GNOME Files file manager, a widely used application on Linux platforms. This flaw, identified by German security researcher Nils Dagsson Moskopp, poses a serious risk as it allows attackers to execute malicious code on impacted machines. Referred to as “Bad Taste” and assigned the identifier CVE-2017-11421, this vulnerability is especially concerning for users employing the gnome-exe-thumbnailer tool to create thumbnails for Windows executables.
The vulnerability exploits an oversight in how GNOME Files processes filenames while generating thumbnails from Windows installer files (.msi), requiring users to have the Wine application installed. During normal operations, the file manager treats the name of these files as executable input to create an image thumbnail. Moskopp demonstrated that attackers could craft a Windows installer containing a malicious VBScript embedded in its filename. When this malicious file is downloaded onto a vulnerable system, it can execute without any further user action, leading to a compromise of the system.
Moskopp elucidated the flaw, stating, “Instead of parsing an MSI file to get its version number, this code creates a script containing the filename for which a thumbnail should be shown and executes that using Wine.” This simplistic script execution presents an effective method for threat actors to deliver payloads directly via filename input, which could trigger harmful scripts from ostensibly benign images or software installations.
While this vulnerability predominantly affects GNOME desktop users, it is important for businesses to be aware of potential attack vectors including the introduction of malicious files via USB drives or drive-by-downloads. With remote work becoming increasingly common, the implications could extend beyond personal machines to corporate environments, where sensitive data may be at risk.
In response to this discovery, Moskopp notified both the GNOME Project and the Debian Project, leading to immediate action taken to patch the vulnerability in the gnome-exe-thumbnailer software. Users on versions prior to 0.9.5 are particularly at risk and are urged to apply updates promptly to mitigate this threat.
For those managing Linux systems, best practices now include removing all files in the /usr/share/thumbnailers directory, considering alternative file management solutions, and uninstalling any applications that may run filenames as executable code without strict checks. Moskopp further recommended that developers should avoid unreliable parsers and should adequately recognize inputs before processing them.
Examining this vulnerability through the lens of the MITRE ATT&CK framework reveals critical tactics such as initial access, where attackers are able to gain control through crafted input, and execution, where scripts trigger unintended code execution. This incident serves as a reminder for business owners to remain vigilant about the software in their environments and ensure that security measures are in place to defend against evolving threats. Adopting proactive strategies could significantly reduce the risk of exploitation from vulnerabilities like “Bad Taste.”