Project

General

Profile

Actions
Copy link

Bug #5874

closed

status_rrd_graph_img.php: Lack of validation on "graph" variable can lead to shell exec

Added by Jim Pingle about 8 years ago. Updated about 7 years ago.

Status:
Resolved
Priority:
Urgent
Assignee:
Jim Pingle
Category:
RRD Graphs
Target version:
2.3
Start date:
02/10/2016
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All

Description

The graph parameter on status_rrd_graph_img.php is somewhat sanitized but still allows the pipe character, which can be used to craft a command that will be executed.

Easiest demo is with some bunk data such as:

https://198.51.100.6/status_rrd_graph_img.php?start=1455092256&end=1455121056&database=system-processor.rrd&style=absolute&graph=&graph=foo|echo%20foo%20|%20logger%20|%20blah

And then look in the system log for "foo".

Happens on 2.2.x and 2.3. I have a fix in mind, will push it once it's tested on both 2.2.x and 2.3.

Actions
Copy link

Also available in: Atom PDF