Project

General

Profile

Actions
Copy link

Bug #7230

closed
JP JP

wizard.php - update_config_field() uses eval to set a value in a way that allows variable protections to be bypassed

Bug #7230: wizard.php - update_config_field() uses eval to set a value in a way that allows variable protections to be bypassed

Added by Jim Pingle over 9 years ago. Updated over 9 years ago.

Status:
Resolved
Priority:
Urgent
Assignee:
Jim Pingle
Category:
Web Interface
Target version:
2.3.3
Start date:
02/07/2017
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All

Description

update_config_field() in wizard.php needs to use eval to construct a variable name that is several array levels deep. The problem lies in the way the value is set for this variable, it can be bypassed in various ways, including using passthru to escape addslashes.

It's easiest to test by using the OpenVPN wizard, get to the step with the interface selection and use firebug to alter the interface value to be" 

wan";echo exec("id");"

JP Updated by Jim Pingle over 9 years ago Actions
Copy link
 #1

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100

Applied in changeset commit:5baea4da88fd6c093582d9c3e9b67cce5d6a1013.

JP Updated by Jim Pingle over 9 years ago Actions
Copy link
 #2

  • Status changed from Feedback to Resolved

Fixed

JP Updated by Jim Pingle over 9 years ago Actions
Copy link
 #3

  • Target version changed from 2.4.0 to 2.3.3

JP Updated by Jim Pingle over 9 years ago Actions
Copy link
 #4

  • Private changed from Yes to No

JP Updated by Jim Pingle over 9 years ago Actions
Copy link
 #5

  • Private changed from No to Yes

JP Updated by Jim Pingle over 9 years ago Actions
Copy link
 #6

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom