Project

General

Profile

Bug #5203

Directory transversal in Configuration History

Added by Fernando Munoz almost 5 years ago. Updated almost 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Web Interface
Target version:
Start date:
09/24/2015
Due date:
% Done:

100%

Estimated time:
Affected Version:
All
Affected Architecture:
All

Description

getcfg parameter doesn't filter chars with as .. or / this way an admin can retrieve other XML files from the system.

- https://localhost:9090/diag_confbak.php?getcfg=../../../../../../../../cf/conf/config

I don't think it's critical since the admin could still download the current config or any other files from other places or SSH, but still you may want to get it fixed.

Associated revisions

Revision 3b635066 (diff)
Added by Jim Pingle almost 5 years ago

Ensure this only contains a partial name, not a path, before attempting to craft a full name and read the file. Fixes #5203.

Revision 635ee4eb (diff)
Added by Jim Pingle almost 5 years ago

Ensure this only contains a partial name, not a path, before attempting to craft a full name and read the file. Fixes #5203.

History

#1 Updated by Jim Pingle almost 5 years ago

  • Subject changed from Directory transversal - Config backup to Directory transversal in Configuration History
  • Category set to Web Interface
  • Status changed from New to Feedback
  • Assignee set to Jim Pingle
  • Target version set to 2.2.5
  • Affected Version set to All
  • Affected Architecture All added
  • Affected Architecture deleted ()

I pushed a fix for this just now. It doesn't appear to be a security problem since the code in question is limited to reading only filenames ending in .xml. The only .xml files with sensitive info on the box are the config.xml files and this page can already read them without any path alterations.

Thanks for the submission, though. In the future, please report any suspected security issues to so that we can handle them more appropriately.

#2 Updated by Jim Pingle almost 5 years ago

  • % Done changed from 0 to 100

#4 Updated by Chris Buechler almost 5 years ago

  • Status changed from Feedback to Resolved

fixed

Also available in: Atom PDF