Actions
Bug #16998
open
FreeRADIUS: Potential configuration manipulation and ACE via Interface instance IP Version value
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:
Description
When editing a FreeRADIUS Interface instance via freeradiusinterfaces.xml the value for IP Version, varinterfaceipversion, is not validated. Users can supply a payload which includes additional content that can inject additional FreeRADIUS configuration directives which could also potentially allow command execution.
The value should be validated against the list of valid options defined in the XML.
Reported by: @lujiefsi
The Interface Type option, varinterfacetype, on the same page also lacks validation, but it is not used directly in the same way, so it is not a danger. However, it should also validate against the static list of options to be safe.
Updated by
Actions