Project

General

Profile

Actions
Copy link

Bug #16898

closed
JP JP

Potential command execution via CR/LF in System Proxy settings

Bug #16898: Potential command execution via CR/LF in System Proxy settings

Added by Jim Pingle 3 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Web Interface
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

The settings for proxy username (proxyuser) and proxy password (proxypass) on system_advanced_misc.php accept CR/LF characters, and other characters which are not valid for their content, which can lead to a potential command execution path.

The proxy credentials are added as shell variables in certain cases (e.g. in /etc/crontab) and specially-crafted payloads can allow adding arbitrary crontab entries which are executed by the cron daemon.

Note that triggering a refresh of the cron content, such as via reboot, ACB settings, or the Cron package is necessary

Files

16898.patch (1018 Bytes) 16898.patch Jim Pingle, 06/17/2026 06:15 PM

JP Updated by Jim Pingle 3 months ago Actions
Copy link
 #1

  • Subject changed from Potential command execution via System Proxy settings to Potential command execution via CR/LF in System Proxy settings

JP Updated by Jim Pingle 3 months ago Actions
Copy link
 #2

Fixed in commit 647e5c290d81edeceb6c27fa35469b908c665daf

Added validation for proxy credentials which flags several invalid characters.

Patch is attached.

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #4

  • Status changed from Feedback to Resolved

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #5

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom