Actions
Bug #16898
closed
JP
JP
Potential command execution via CR/LF in System Proxy settings
Bug #16898:
Potential command execution via CR/LF in System Proxy settings
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
The settings for proxy username (proxyuser) and proxy password (proxypass) on system_advanced_misc.php accept CR/LF characters, and other characters which are not valid for their content, which can lead to a potential command execution path.
The proxy credentials are added as shell variables in certain cases (e.g. in /etc/crontab) and specially-crafted payloads can allow adding arbitrary crontab entries which are executed by the cron daemon.
Note that triggering a refresh of the cron content, such as via reboot, ACB settings, or the Cron package is necessary
Files
Actions