Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bugfix: command injection vulnerabilities #888

Merged
merged 10 commits into from
May 10, 2021
Merged

Bugfix: command injection vulnerabilities #888

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
3a41b52
Update method to POST + escapeshellarg()
billz May 1, 2021
6bfb3a3
Add escapeshellarg() for iwgetid interface
billz May 1, 2021
90aea4c
Set locale for utf-8 support, remove mb_escapeshellarg (deprecated)
billz May 2, 2021
4baac6e
Escape constant, arg + extension
billz May 2, 2021
6567f99
Restrict control scripts to root user, thx Omri Inbar
billz May 2, 2021
e76c31c
revert part of 3a41b52c to respect http method's purpose
glaszig May 6, 2021
3969db6
Validate wpa_passphrase w/ ctype_print
billz May 7, 2021
45a50ed
use special multibyte shell escaping to support unicode ssid names wi…
glaszig May 8, 2021
947ccf7
add margin to wifi qr code to have it work with dark background (i.e.…
glaszig May 8, 2021
4841d93
Remove locale include (unused)
billz May 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ajax/networking/get_netcfg.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@
require '../../includes/csrf.php';
require_once '../../includes/config.php';

$interface = $_GET['iface'];
$interface = $_POST['iface'];

if (isset($interface)) {
// fetch dnsmasq.conf settings for interface
exec('cat '. RASPI_DNSMASQ_PREFIX.$interface.'.conf', $return);
exec('cat '. escapeshellarg(RASPI_DNSMASQ_PREFIX.$interface.'.conf'), $return);
$conf = ParseConfig($return);

$dhcpdata['DHCPEnabled'] = empty($conf) ? false : true;
Expand Down
3 changes: 2 additions & 1 deletion app/img/wifi-qr-code.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
require_once '../../includes/config.php';
require_once '../../includes/defaults.php';
require_once '../../includes/functions.php';
require_once '../../includes/locale.php';

// prevent direct file access
if (!isset($_SERVER['HTTP_REFERER'])) {
Expand Down Expand Up @@ -41,7 +42,7 @@ function qr_encode($str)
$password = qr_encode($password);

$data = "WIFI:S:$ssid;T:$type;P:$password;$hidden;";
$command = "qrencode -t svg -m 0 -o - " . mb_escapeshellarg($data);
$command = "qrencode -t svg -m 0 -o - " . escapeshellarg($data);
$svg = shell_exec($command);

$config_mtime = filemtime(RASPI_HOSTAPD_CONFIG);
Expand Down
4 changes: 2 additions & 2 deletions app/js/custom.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,8 +178,8 @@ Populates the DHCP server form fields
Option toggles are set dynamically depending on the loaded configuration
*/
function loadInterfaceDHCPSelect() {
var iface = $('#cbxdhcpiface').val();
$.get('ajax/networking/get_netcfg.php?iface='+iface,function(data){
var strInterface = $('#cbxdhcpiface').val();
$.post('ajax/networking/get_netcfg.php',{iface:strInterface},function(data){
jsonData = JSON.parse(data);
$('#dhcp-iface')[0].checked = jsonData.DHCPEnabled;
$('#txtipaddress').val(jsonData.StaticIP);
Expand Down
13 changes: 0 additions & 13 deletions includes/functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -518,19 +518,6 @@ function cache($key, $callback)
}
}

// insspired by
// http://markushedlund.com/dev/php-escapeshellarg-with-unicodeutf-8-support
function mb_escapeshellarg($arg)
{
$isWindows = strtolower(substr(PHP_OS, 0, 3)) === 'win';
if ($isWindows) {
$escaped_arg = str_replace(array('"', '%'), '', $arg);
} else {
$escaped_arg = str_replace("'", "'\\''", $arg);
}
return "\"$escaped_arg\"";
}

function dnsServers()
{
$data = json_decode(file_get_contents("./config/dns-servers.json"));
Expand Down
3 changes: 1 addition & 2 deletions includes/hostapd.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,9 +59,8 @@ function DisplayHostAPDConfig()
}
}
}

exec('cat '. RASPI_HOSTAPD_CONFIG, $hostapdconfig);
exec('iwgetid '. $_POST['interface']. ' -r', $wifiNetworkID);
exec('iwgetid '. escapeshellarg($_POST['interface']). ' -r', $wifiNetworkID);
if (!empty($wifiNetworkID[0])) {
$managedModeEnabled = true;
}
Expand Down
22 changes: 12 additions & 10 deletions installers/common.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,7 +213,7 @@ function _create_hostapd_scripts() {
# Move service control shell scripts
sudo cp "$webroot_dir/installers/"service*.sh "$raspap_dir/hostapd" || _install_status 1 "Unable to move service control scripts"
# Make enablelog.sh and disablelog.sh not writable by www-data group.
sudo chown -c root:"$raspap_user" "$raspap_dir/hostapd/"*.sh || _install_status 1 "Unable change owner and/or group"
sudo chown -c root:root "$raspap_dir/hostapd/"*.sh || _install_status 1 "Unable change owner and/or group"
sudo chmod 750 "$raspap_dir/hostapd/"*.sh || _install_status 1 "Unable to change file permissions"
_install_status 0
}
Expand All @@ -228,7 +228,7 @@ function _create_lighttpd_scripts() {
sudo cp "$webroot_dir/installers/"configport.sh "$raspap_dir/lighttpd" || _install_status 1 "Unable to move service control scripts"
# Make configport.sh writable by www-data group
echo "Changing file ownership"
sudo chown -c root:"$raspap_user" "$raspap_dir/lighttpd/"*.sh || _install_status 1 "Unable change owner and/or group"
sudo chown -c root:root "$raspap_dir/lighttpd/"*.sh || _install_status 1 "Unable change owner and/or group"
sudo chmod 750 "$raspap_dir/lighttpd/"*.sh || _install_status 1 "Unable to change file permissions"
_install_status 0
}
Expand Down Expand Up @@ -310,8 +310,9 @@ function _install_adblock() {
echo "Moving and setting permissions for blocklist update script"
sudo cp "$webroot_dir/installers/"update_blocklist.sh "$raspap_dir/adblock" || _install_status 1 "Unable to move blocklist update script"

# Make blocklists and update script writable by www-data group
sudo chown -c root:"$raspap_user" "$raspap_dir/adblock/"*.* || _install_status 1 "Unable to change owner/group"
# Make blocklists writable by www-data group, restrict update scripts to root
sudo chown -c root:"$raspap_user" "$raspap_dir/adblock/"*.txt || _install_status 1 "Unable to change owner/group"
sudo chown -c root:root "$raspap_dir/adblock/"*.sh || _install_status 1 "Unable to change owner/group"
sudo chmod 750 "$raspap_dir/adblock/"*.sh || install_error "Unable to change file permissions"

# Create 090_adblock.conf and write values to /etc/dnsmasq.d
Expand Down Expand Up @@ -400,11 +401,11 @@ function _create_openvpn_scripts() {
_install_log "Creating OpenVPN control scripts"
sudo mkdir $raspap_dir/openvpn || _install_status 1 "Unable to create directory '$raspap_dir/openvpn'"

# Move service auth control & logging shell scripts
# Move service auth control & logging shell scripts
sudo cp "$webroot_dir/installers/"configauth.sh "$raspap_dir/openvpn" || _install_status 1 "Unable to move auth control script"
sudo cp "$webroot_dir/installers/"openvpnlog.sh "$raspap_dir/openvpn" || _install_status 1 "Unable to move logging script"
# Make scripts executable by www-data group
sudo chown -c root:"$raspap_user" "$raspap_dir/openvpn/"*.sh || _install_status 1 "Unable change owner and/or group"
# Restrict script execution to root user
sudo chown -c root:root "$raspap_dir/openvpn/"*.sh || _install_status 1 "Unable change owner and/or group"
sudo chmod 750 "$raspap_dir/openvpn/"*.sh || _install_status 1 "Unable to change file permissions"
_install_status 0
}
Expand Down Expand Up @@ -490,9 +491,10 @@ function _move_config_file() {
_install_status 1 "'$raspap_dir' directory doesn't exist"
fi

# Copy config file and make writable by www-data group
_install_log "Moving configuration file to $raspap_dir"
sudo cp "$webroot_dir"/raspap.php "$raspap_dir" || _install_status 1 "Unable to move files to '$raspap_dir'"
sudo chown -R $raspap_user:$raspap_user "$raspap_dir" || _install_status 1 "Unable to change file ownership for '$raspap_dir'"
sudo chown -c $raspap_user:"$raspap_user" "$raspap_dir"/raspap.php || _install_status 1 "Unable change owner and/or group"
}

# Set up default configuration
Expand All @@ -506,8 +508,8 @@ function _default_configuration() {
sudo cp $webroot_dir/config/dhcpcd.conf /etc/dhcpcd.conf || _install_status 1 "Unable to move dhcpcd configuration file"
sudo cp $webroot_dir/config/defaults.json $raspap_network || _install_status 1 "Unable to move defaults.json settings"

echo "Changing file ownership of $raspap_dir"
sudo chown -R $raspap_user:$raspap_user "$raspap_dir" || _install_status 1 "Unable to change file ownership for '$raspap_dir'"
echo "Changing file ownership of ${raspap_network}/defaults.json"
sudo chown $raspap_user:$raspap_user "$raspap_network"/defaults.json || _install_status 1 "Unable to change file ownership for defaults.json"

echo "Checking for existence of /etc/dnsmasq.d"
[ -d /etc/dnsmasq.d ] || sudo mkdir /etc/dnsmasq.d
Expand Down