Actions
Bug #16899
closed
JP
JP
Potential command execution via CR/LF in OpenVPN settings
Bug #16899:
Potential command execution via CR/LF in OpenVPN settings
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
The settings for dns_domain and netbios_scope on vpn_openvpn_server.php accept CR/LF characters and other characters which are not valid for their content, such as double quotes, which can lead to a potential command execution path.
Specially-crafted payloads can allow adding arbitrary OpenVPN configuration directives, including directives which execute commands such as up and route-up.
Files
JP Updated by Jim Pingle 3 months ago
- File 16899.patch 16899.patch added
- Status changed from New to Feedback
- % Done changed from 0 to 100
Fixed in commit fd301381e29f6fb217d1388ed56581e9b4ad6186
Added validation for DNS Domain and NetBIOS Scope ID.
Patch is attached.
JP Updated by Jim Pingle about 1 month ago
- Status changed from Feedback to Resolved
JP Updated by Jim Pingle about 1 month ago
- Private changed from Yes to No
Actions