Project

General

Profile

Actions
Copy link

Bug #16899

closed
JP JP

Potential command execution via CR/LF in OpenVPN settings

Bug #16899: Potential command execution via CR/LF in OpenVPN settings

Added by Jim Pingle 3 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
OpenVPN
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

The settings for dns_domain and netbios_scope on vpn_openvpn_server.php accept CR/LF characters and other characters which are not valid for their content, such as double quotes, which can lead to a potential command execution path.

Specially-crafted payloads can allow adding arbitrary OpenVPN configuration directives, including directives which execute commands such as up and route-up.

Files

16899.patch (4.35 KB) 16899.patch Jim Pingle, 06/17/2026 07:48 PM

JP Updated by Jim Pingle 3 months ago Actions
Copy link
 #1

Fixed in commit fd301381e29f6fb217d1388ed56581e9b4ad6186

Added validation for DNS Domain and NetBIOS Scope ID.

Patch is attached.

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #3

  • Status changed from Feedback to Resolved

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #4

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom