# CVE Fixes for mimeTeX 1.75

## CVE-2024-40446 — Code injection / arbitrary command execution

- **Class:** CWE-94 (Improper Control of Generation of Code)
- **CVSS 3.1:** 9.8 (Critical)
- **Affected:** mimeTeX before v1.77
- **Status:** Fixed in `mimetex.c` (this tree)

### Root cause

The `\mathtex{…}` directive is handled by `rastmathtex()` (`mimetex.c:~12910`).
It concatenates the user-supplied expression directly into a shell command
string and runs it through `popen()`:

```c
strcat(command, subexpr);          /* user input, unescaped */
...
wget = popen(command, "r");        /* executed by /bin/sh   */
```

Every other external-action directive (`\input`, `\counter`, `\environment`)
is gated by mimeTeX's security level — a directive runs only when
`seclevel <= directiveseclevel`, which is false in the default configuration,
so those directives are disabled by default. `\mathtex` had **no such gate at
all**, so crafted input such as `` \mathtex{`cmd`} `` or `\mathtex{$(cmd)}`
executed arbitrary shell commands regardless of the configured security level.

### The fix (defense in depth)

Four edits to `mimetex.c`:

1. **`MATHTEXSECURITY` macro** (`~line 872`) — mirrors `ENVIRONSECURITY`;
   defaults to the restricted `DEFAULTSECURITY` (8), so `\mathtex` is now
   **disabled by default**. Opt in with `-DMATHTEXOK` or a lower `-DSECURITY`.
2. **`mathtexseclevel` global** (`~line 923`) — alongside the existing
   seclevel globals.
3. **Initialization in `main()`** (`~line 16960`) —
   `mathtexseclevel = MATHTEXSECURITY;`.
4. **Security gate + sanitizer in `rastmathtex()`** — refuses with a rendered
   "[\mathtex not permitted]" image when `seclevel > mathtexseclevel`, and,
   even when `\mathtex` is explicitly enabled, rejects shell metacharacters
   (`` ` $ ; | & < > " \n \r ``) before building the `popen()` command.
   LaTeX-essential characters (`\`, `{`, `}`, `^`, `_`, …) are preserved.

### Verification

- Compiles cleanly:
  `gcc -std=gnu89 -DAA mimetex.c gifsave.c -lm -o mimetex.cgi`
  (The C23 prototype / array-bounds warnings from modern compilers are
  pre-existing in this 2008-era K&R code and unrelated to the change.)
- Default build: `` \mathtex{`touch /tmp/PWNED`} `` → refused, no file created.
- With `-DMATHTEXOK`: both `` `…` `` and `$(…)` injections → blocked by the
  sanitizer, no file created.
- Normal expression `x^2+\frac{1}{2}` → renders correctly (no regression).

### Build notes

- Default builds are safe: `\mathtex` will not shell out.
- To deliberately re-enable the mathTeX webservice bridge, build with
  `-DMATHTEXOK` (or lower `-DSECURITY`). Even then, shell metacharacters in the
  expression are refused.

## Related: CVE-2024-40445

The sibling CVE also affects mimeTeX before v1.77. The `\input`, `\counter`,
and `\environment` directives are already disabled by default in this tree via
the same security-level mechanism (`seclevel <= directiveseclevel` is false by
default), so they are not exploitable in a default build. Re-enabling them
(`-DINPUTOK`, `-DCOUNTEROK`, `-DENVIRONOK`, lower `-DSECURITY`) exposes those
features and should only be done in trusted environments.

## References

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-40446
- CVE reference repo: https://github.com/TaiYou-TW/CVE-2024-40445_CVE-2024-40446
- Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2024-40446
