Bug #16244
open
Gateway adress not trimed
Added by Grischa Zengel 4 months ago.
Updated 10 days ago.
Affected Architecture:
All
Description
After upgrading from 2.7.2 to 2.8.0 I got RPCXML errors.
On second pfsense I got:
/xmlrpc.php: The command '/usr/local/bin/dpinger -S -r 0 -i GWV6_WAN -B 2a02:::2 -p /var/run/dpinger_GWV6_WAN~2a02::2~2a02::1 .pid -u /var/run/dpinger_GWV6_WAN~2a02::2~2a02::1 .sock -C "/etc/rc.gateway_alarm" -d 1 -s 500 -l 2000 -t 60000 -A 1000 -D 500 -L 20 2a02::1 >/dev/null' returned exit code '1', the output was ''
If you have a look you will see a space before file extensions.
I see two problems:
1. surround files names with "".
2. trim gateway addresses.
<gateway_item>
<interface>wan</interface>
<gateway>2a02::1 </gateway>
<name>GWV6_WAN</name>
<weight>1</weight>
<ipprotocol>inet6</ipprotocol>
<descr></descr>
<gw_down_kill_states></gw_down_kill_states>
</gateway_item>
Grischa Zengel wrote in #note-1:
[...]
Hello,
If you edit your Gateway under System --> Routing --> Gateways, do you have a whitespace at the end of your IP address field?
Yes, look at XML you will see a space. It was added by an error in 2.7.2 and made problems after upgrade.
I think it is/was possible to inject commands because the gateway is used unmasked and file names are not put between "".
- Priority changed from High to Very Low
Grischa Zengel wrote in #note-3:
I think it is/was possible to inject commands because the gateway is used unmasked and file names are not put between "".
The last part isn't possible now or any time that recently, as the address is validated in various ways. Someone would have to find a way to set that gateway to a non-IP address value and the only way that is possible would be by hand-editing the configuration. If they can do that, there are many worse things they could do.
I can't create a gateway with a trailing space in any current version or even in CE 2.7.2, so either the mistake was made much earlier than that, or it was done via hand editing the configuration.
It wouldn't hurt to trim the gateway address here and escape that command parameter, but I'm not seeing any recent scenario that would make it necessary.
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by