Attention is currently required from: d12fk, plaisthos.
Hello plaisthos,
I'd like you to do a code review.
Please visit
http://gerrit.openvpn.net/c/openvpn/+/1883?usp=email
to review the following change.
Change subject: openvpnserv: detect sibling dirs in CheckConfigPath
......................................................................
openvpnserv: detect sibling dirs in CheckConfigPath
If the config_dir value in the registry has no trailing backslash the
check doesn't actually guarantee that a file is located within
config_dir, because a sibling dir with the same prefix, e.g. 'config'
and 'config-evil' will match and produce a positive verdict.
By also checking that there is a path separator after config_dir
prevents this attack.
Reported-By: Harshit Varu <[email protected]>
Tested-By: Harshit Varu <[email protected]>
CVE: 2026-81830
Github: OpenVPN/openvpn-private-issues#166
Change-Id: Ica5d43989b441d4377a3908f811a2953b7a9d45a
Signed-off-by: Heiko Hund <[email protected]>
---
M src/openvpnserv/validate.c
1 file changed, 14 insertions(+), 3 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/83/1883/1
diff --git a/src/openvpnserv/validate.c b/src/openvpnserv/validate.c
index 770a7a0..b0fb6b85 100644
--- a/src/openvpnserv/validate.c
+++ b/src/openvpnserv/validate.c
@@ -56,7 +56,9 @@
/*
* Check workdir\fname is inside config_dir
- * The logic here is simple: we may reject some valid paths if ..\ is in any
of the strings
+ * The logic here is simple:
+ * we may reject some valid paths if ".." is in the filename
+ * or if there's no "\" after the config directory
*/
static BOOL
CheckConfigPath(const WCHAR *workdir, const WCHAR *fname, const settings_t *s)
@@ -82,9 +84,18 @@
}
config_dir = s->config_dir;
+ size_t config_dir_len = wcslen(config_dir);
- if (wcsncmp(config_dir, config_file, wcslen(config_dir)) == 0
- && wcsstr(config_file + wcslen(config_dir), L"..") == NULL)
+ /* check for a path separator after config_dir */
+ if (config_dir_len && config_dir_len < wcslen(config_file)
+ && config_dir[config_dir_len - 1] != L'\\'
+ && config_file[config_dir_len] != L'\\')
+ {
+ return FALSE;
+ }
+
+ if (wcsncmp(config_dir, config_file, config_dir_len) == 0
+ && wcsstr(config_file + config_dir_len, L"..") == NULL)
{
return TRUE;
}
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1883?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: release/2.6
Gerrit-Change-Id: Ica5d43989b441d4377a3908f811a2953b7a9d45a
Gerrit-Change-Number: 1883
Gerrit-PatchSet: 1
Gerrit-Owner: cron2 <[email protected]>
Gerrit-Reviewer: d12fk <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
Gerrit-Attention: d12fk <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
