Bug 1557840 (CVE-2018-8741)

Summary:	CVE-2018-8741 SquirrelMail: Directory traversal flaw in Deliver.class.php can allow a remote attacker to retrieve or delete arbitrary files
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	mhlavink
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-03-26 15:44:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1557841, 1560342, 1557842, 1560341
Bug Blocks:	1557843

Description Sam Fowler 2018-03-19 03:56:11 UTC

SquirrelMail through version 1.4.22 is vulnerable to a directory traversal flaw in the handling of the $message->att_local_name field in Deliver.class.php. A remote attacker that first authenticates to the application could exploit this to retrieve or delete arbitrary files via mail attachment.


External References:

https://insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18/
http://www.openwall.com/lists/oss-security/2018/03/17/2


Upstream Issue:

https://sourceforge.net/p/squirrelmail/bugs/2846/

Comment 1 Sam Fowler 2018-03-19 03:56:34 UTC

Created squirrelmail tracking bugs for this issue:

Affects: fedora-all [bug 1557842]
Affects: epel-all [bug 1557841]

Comment 2 Pedro Yóssis Silva Barbosa 2018-03-23 21:09:52 UTC

Is it really a bug? The report states that 

"The reference to $message->att_local_name in line 284 is controlled by the attacker."

But I am not able to confirm that. The value of $message->att_local_name is generated randomly. In src/compose.php:

$localfilename = GenerateRandomString(32, '', 7);
$full_localfilename = "$hashed_attachment_dir/$localfilename";
while (file_exists($full_localfilename)) {
    $localfilename = GenerateRandomString(32, '', 7);
    $full_localfilename = "$hashed_attachment_dir/$localfilename";
}
$fp = fopen ("$hashed_attachment_dir/$localfilename", 'wb');

$message->att_local_name = $localfilename;

By default, these files are stored in /var/spool/squirrelmail/attach.

Comment 3 Doran Moppert 2018-03-26 00:51:50 UTC

In reply to comment 2:
> Is it really a bug? The report states that 
> 
> "The reference to $message->att_local_name in line 284 is controlled by the
> attacker."
> 
> But I am not able to confirm that. The value of $message->att_local_name is
> generated randomly. In src/compose.php:

att_local_name is generated randomly, but it then passes through attacker control as a hidden form field.

src/compose.php:
1356:        addHidden('attachments', serialize($attach_array)) : '').
..
114:sqgetGlobalVar('attachments',           $attachments,           SQ_POST);
320:        if (!empty($attachments)) 
321:            $attachments = unserialize($attachments);

Comment 4 Doran Moppert 2018-03-26 01:06:03 UTC

Statement:

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 5 Doran Moppert 2018-03-26 01:06:29 UTC

Created squirrelmail tracking bugs for this issue:

Affects: fedora-all [bug 1560341]
Affects: epel-all [bug 1560342]