Attachment 40386 Details for Bug 14408 – [PASSED QA] Bug 14408 Path traversal vulnerability

[patch] [PASSED QA] Bug 14408 Path traversal vulnerability

PASSED-QA-Bug-14408-Path-traversal-vulnerability.patch (text/plain), 1.70 KB, created by Kyle M Hall (khall) on 2015-06-19 14:45:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kyle M Hall (khall)

Created: 2015-06-19 14:45:06 UTC

Size: 1.70 KB

patch

obsolete

>From 386e3d0c48c8e02d5ce686b6b3587949cb8c4497 Mon Sep 17 00:00:00 2001
>From: Jonathan Druart <jonathan.druart@koha-community.org>
>Date: Fri, 19 Jun 2015 10:12:45 +0200
>Subject: [PATCH] [PASSED QA] Bug 14408 Path traversal vulnerability
>
>/cgi-bin/koha/svc/virtualshelves/search
>/cgi-bin/koha/svc/members/search
>
>Are vulnerable
>
>To test:
>1/ Hit /cgi-bin/koha/svc/members/search?template_path=members/tables/members_results.tt
>  Notice you get a valid JSON response
>2/ Hit
>/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
>  (You may have add more ..%2f or remove them to get the correct path)
>  Notice you can see the contents of the /etc/passwd file
>3/ Hit
>/cgi-bin/koha/svc/members/search?template_path=test%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
>4/ Apply patch
>5/ Hit the first url again, notice it still works
>6/ Hit the second url notice it now errors with a file not found
>7/ Hit the third url notice it now errors with a file not found
>
>Repeat for the other script also
>
>Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
>
>Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
>---
> C4/Auth.pm |    4 ++++
> 1 files changed, 4 insertions(+), 0 deletions(-)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index 0d21575..a048c97 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -158,6 +158,10 @@ sub get_template_and_user {
> 
>     C4::Context->interface( $in->{type} );
> 
>+    # Sanitize template path to avoid path traversal
>+    $in->{template_name} =~ s|^/||;
>+    $in->{template_name} =~ s|\.\.||g;
>+
>     $in->{'authnotrequired'} ||= 0;
>     my $template = C4::Templates::gettemplate(
>         $in->{'template_name'},
>-- 
>1.7.2.5

Actions: View | Diff | Splinter Review

Attachments on bug 14408: 40271 | 40336 | 40347 | 40348 | 40374 | 40375 | 40386 | 40387 | 40443 | 40445 | 40446 | 40447 | 40491 | 40492 | 40493 | 40564 | 40610