Bugzilla – Attachment 40336 Details for
Bug 14408
Path traversal vulnerabilty
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 14408 Path traversal vulnerability
Bug-14408-Path-traversal-vulnerability.patch (text/plain), 2.16 KB, created by
Chris Cormack
on 2015-06-18 21:11:02 UTC
(
hide
)
Description:
Bug 14408 Path traversal vulnerability
Filename:
MIME Type:
Creator:
Chris Cormack
Created:
2015-06-18 21:11:02 UTC
Size:
2.16 KB
patch
obsolete
>From 2eaf4cc857cf582b7592c5426d65554926494d17 Mon Sep 17 00:00:00 2001 >From: Chris Cormack <chrisc@catalyst.net.nz> >Date: Fri, 19 Jun 2015 09:07:44 +1200 >Subject: [PATCH] Bug 14408 Path traversal vulnerability > >/cgi-bin/koha/svc/virtualshelves/search >/cgi-bin/koha/svc/members/search > >Are vulnerable > >To test: >1/ Hit /cgi-bin/koha/svc/members/search?template_path=members/tables/members_results.tt > Notice you get a valid JSON response >2/ Hit >/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd > (You may have add more ..%2f or remove them to get the correct path) > Notice you can see the contents of the /etc/passwd file >3/ Apply patch >4/ Hit the first url again, notice it still works >5/ Hit the second url notice it now errors with a file not found > >Repeat for the other script also >--- > svc/members/search | 4 +++- > svc/virtualshelves/search | 4 +++- > 2 files changed, 6 insertions(+), 2 deletions(-) > >diff --git a/svc/members/search b/svc/members/search >index 6343e2e..caf4682 100755 >--- a/svc/members/search >+++ b/svc/members/search >@@ -29,9 +29,11 @@ use Koha::DateUtils qw( output_pref dt_from_string ); > my $input = new CGI; > > exit unless $input->param('template_path'); >+my $template_path= $input->param('template_path'); >+ $template_path =~ s/[^a-zA-Z_-]*//; #sanitzie > > my ($template, $user, $cookie) = get_template_and_user({ >- template_name => $input->param('template_path'), >+ template_name => $template_path, > query => $input, > type => "intranet", > authnotrequired => 0, >diff --git a/svc/virtualshelves/search b/svc/virtualshelves/search >index ef1448c..b33b03e 100755 >--- a/svc/virtualshelves/search >+++ b/svc/virtualshelves/search >@@ -12,8 +12,10 @@ my $input = new CGI; > > exit unless $input->param('template_path'); > >+my $template_path= $input->param('template_path'); >+ $template_path =~ s/[^a-zA-Z_-]*//; #sanitzie > my ($template, $user, $cookie) = get_template_and_user({ >- template_name => $input->param('template_path'), >+ template_name => $template_path, > query => $input, > type => "intranet", > authnotrequired => 0, >-- >2.1.4
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 14408
:
40271
|
40336
|
40347
|
40348
|
40374
|
40375
|
40386
|
40387
|
40443
|
40445
|
40446
|
40447
|
40491
|
40492
|
40493
|
40564
|
40610