Actions
Bug #16899
closed
JP
JP
Potential command execution via CR/LF in OpenVPN settings
Bug #16899:
Potential command execution via CR/LF in OpenVPN settings
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
The settings for dns_domain and netbios_scope on vpn_openvpn_server.php accept CR/LF characters and other characters which are not valid for their content, such as double quotes, which can lead to a potential command execution path.
Specially-crafted payloads can allow adding arbitrary OpenVPN configuration directives, including directives which execute commands such as up and route-up.
Files
Actions