Attachment 665754 Details for Bug 888518 – CVE-2012-5646-restorer.php.patch

[patch] CVE-2012-5646-restorer.php.patch

CVE-2012-5646-restorer.php.patch (text/plain), 1.78 KB, created by Kurt Seifried on 2012-12-18 20:56:30 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2012-12-18 20:56:30 UTC

Size: 1.78 KB

patch

obsolete

>From d6ccf806aacbf8f89c36c0cc0d5d461f65128183 Mon Sep 17 00:00:00 2001
>From: Michael Scherer <misc@zarb.org>
>Date: Fri, 23 Nov 2012 19:27:27 +0100
>Subject: [PATCH 1/2] Check the format of $uuid before running a command with
> shell_exec
>
>PATH_INFO is provided by the client, according to http://php.net/manual/en/reserved.variables.server.php
>
>    Contains any client-provided pathname information trailing the actual script
>    filename but preceding the query string, if available. For instance,
>    if the current script was accessed via the URL
>    http://www.example.com/php/path_info.php/some/stuff?foo=bar, then
>    $_SERVER['PATH_INFO'] would contain /some/stuff.
>
>While external protection can be setup ( mod_security, php restrictions,
>firewalls, etc ), directly feeding a user provided string to the shell
>is not a good idea. So in order to make sure that only a uuid is given,
>let's use a regexp.
>---
> node-util/www/html/restorer.php | 16 ++++++++++------
> 1 file changed, 10 insertions(+), 6 deletions(-)
>
>diff --git a/node-util/www/html/restorer.php b/node-util/www/html/restorer.php
>index 49694dc..ec61cef 100755
>--- a/node-util/www/html/restorer.php
>+++ b/node-util/www/html/restorer.php
>@@ -1,10 +1,14 @@
> <?php
> 
> list($blank, $uuid, $blank) = split("/", $_SERVER["PATH_INFO"]);
>-shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
>-
>-sleep(2);
>-$url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
>-header("Location: $url");
>-
>+if (preg_match('/[0-9a-f]{32}/', $uuid)) {
>+    shell_exec("/usr/sbin/oo-restorer-wrapper.sh $uuid");
>+    sleep(2);
>+    $url=str_replace("/$uuid", "", $_SERVER["PATH_INFO"]);
>+    header("Location: $url");
>+} else {
>+    // someone is trying to attack
>+    error_log("Wrong uuid $uuid given to restorer.php");
>+    header('HTTP/1.0 403 Forbidden');
>+}
> ?>
>-- 
>1.8.0
>

Actions: View | Diff

Attachments on bug 888518: 665754