Attachment 40491 Details for Bug 14408 – [PASSED QA] Bug 14408 Path Traversal error

[patch] [PASSED QA] Bug 14408 Path Traversal error

PASSED-QA-Bug-14408-Path-Traversal-error.patch (text/plain), 1.99 KB, created by Katrin Fischer on 2015-06-22 20:32:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Katrin Fischer

Created: 2015-06-22 20:32:10 UTC

Size: 1.99 KB

patch

obsolete

>From fe98783759dd46e5dafbedcb42b05916018181fc Mon Sep 17 00:00:00 2001
>From: Chris <chris@bigballofwax.co.nz>
>Date: Mon, 22 Jun 2015 05:23:52 +0000
>Subject: [PATCH] [PASSED QA] Bug 14408 Path Traversal error
>
>Counter counter patch
>Please test well, including with the null byte %00, this uses a whitelisting to only allow files ending with .tt
>and not allowing ../etc
>
>Note the previous patch tries to protect against /etc/passwd
>but //etc/passwd is now vulnerable.  I do think a whitelist is safer than trying to do a blacklist
>
>/cgi-bin/koha/svc/virtualshelves/search
>/cgi-bin/koha/svc/members/search
>
>Are vulnerable
>
>To test:
>1/ Hit /cgi-bin/koha/svc/members/search?template_path=members/tables/members_results.tt
>  Notice you get a valid JSON response
>2/ Hit
>/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
>  (You may have add more ..%2f or remove them to get the correct path)
>  Notice you can see the contents of the /etc/passwd file
>3/ Hit
>/cgi-bin/koha/svc/members/search?template_path=test%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
>4/ Apply patch
>5/ Hit the first url again, notice it still works
>6/ Hit the second url notice it now errors with a file not found
>7/ Hit the third url notice it now errors with a file not found
>
>Repeat for the other script also
>
>Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
>
>Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
>---
> C4/Auth.pm | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/C4/Auth.pm b/C4/Auth.pm
>index c4719e6..1f1b734 100644
>--- a/C4/Auth.pm
>+++ b/C4/Auth.pm
>@@ -158,6 +158,9 @@ sub get_template_and_user {
> 
>     C4::Context->interface( $in->{type} );
> 
>+    my $safe_chars = 'a-zA-Z_\-\/';
>+    die "bad template path" unless $in->{'template_name'} =~ m/^[$safe_chars]+.tt?$/ig; #sanitize input
>+
>     $in->{'authnotrequired'} ||= 0;
>     my $template = C4::Templates::gettemplate(
>         $in->{'template_name'},
>-- 
>1.9.1

Actions: View | Diff | Splinter Review

Attachments on bug 14408: 40271 | 40336 | 40347 | 40348 | 40374 | 40375 | 40386 | 40387 | 40443 | 40445 | 40446 | 40447 | 40491 | 40492 | 40493 | 40564 | 40610