webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

{proxy,chpasswd}.cgi: Fix a remote code execution vulnerability

Browse Source 
Handcrafted requests with shell commands could be sent to these
CGI files and gain shell access as unprivileged user.

References: #11087

Reported-by: Yann Cam <yann.cam@gmail.com>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer
2016-04-04 16:41:30 +01:00
parent f367d5b388
commit 0aff7b8196
2 changed files with 16 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
html/cgi-bin/proxy.cgi
View File

@@ -27,6 +27,7 @@
#
use strict;
use Apache::Htpasswd;
# enable only the following on debugging purpose
#use warnings;
@@ -4134,7 +4135,9 @@ sub adduser
close(FILE);
} else {
&deluser($str_user);
system("/usr/sbin/htpasswd -b $userdb $str_user $str_pass");
my $htpasswd = new Apache::Htpasswd("$userdb");
$htpasswd->htpasswd($str_user, $str_pass);
}
if ($str_group eq 'standard') { open(FILE, ">>$stdgrp");