Project

General

Profile

Bug #5874

status_rrd_graph_img.php: Lack of validation on "graph" variable can lead to shell exec

Added by Jim Pingle over 3 years ago. Updated over 2 years ago.

Status:
Resolved
Priority:
Urgent
Assignee:
Category:
RRD Graphs
Target version:
Start date:
02/10/2016
Due date:
% Done:

100%

Estimated time:
Affected Version:
All
Affected Architecture:
All

Description

The graph parameter on status_rrd_graph_img.php is somewhat sanitized but still allows the pipe character, which can be used to craft a command that will be executed.

Easiest demo is with some bunk data such as:

https://198.51.100.6/status_rrd_graph_img.php?start=1455092256&end=1455121056&database=system-processor.rrd&style=absolute&graph=&graph=foo|echo%20foo%20|%20logger%20|%20blah

And then look in the system log for "foo".

Happens on 2.2.x and 2.3. I have a fix in mind, will push it once it's tested on both 2.2.x and 2.3.

Associated revisions

Revision 6a109e3e (diff)
Added by Jim Pingle over 3 years ago

Make RRD lists global, validate graph name using whitelist of known values rather than blacklist of characters, beef up validation and escaping of related values while here. Fixes #5874 for 2.2.x

Revision 7cd2add4 (diff)
Added by Jim Pingle over 3 years ago

Make RRD lists global, validate graph name using whitelist of known values rather than blacklist of characters, beef up validation and escaping of related values while here. Fixes #5874 for 2.3

History

#1 Updated by Jim Pingle over 3 years ago

  • Status changed from Assigned to Feedback
  • % Done changed from 0 to 100

#3 Updated by Jim Pingle over 3 years ago

  • Status changed from Feedback to Resolved

Feedback from the original reporter confirms it is now fixed.

#4 Updated by Jim Pingle over 2 years ago

  • Private changed from Yes to No

Also available in: Atom PDF