#704 input values not getting checked enough
As of Webmin 1.020, the useradmin module doesn't check
the inputs well enough. Many invalid/undesirable
characters can get entered, which when combined with
other methods could expose access vulnerabilities. The
save_group.cgi.diff and save_user.cgi.diff-1 files
address these concerns.
The save_user.cgi.diff-2 file is useful for a default
setting in which home directories are automatically
generated. (I found the current default settings and
handling unsatisfactory.)
Also, something for which I do not have a patch
against, but is a common CGI exploit: the return values
of the "shell" variable are not checked against the
allowed list (i.e., /etc/shells), so it is possible
that someone modifying the values that the form returns
could set up an arbitrary program to be run at login.
I have not written a patch for this yet because I
suspect that the useradmin module is not the only one
affected by it, and a major overhaul would need to be
done to make Webmin safe against these types of exploits.
Thank you,
Dimitri Aivaliotis
Systems Engineer
SFI Technology Services
Patch that improves input checking
Patch that improves input checking
Patch that makes autohome defaults nicer
Logged In: YES
user_id=129364
I think those patches to limit the allowed user and group
names are rather
strict, as they don't allow characters like +, @ and /. I
really only want to
filter out those that would cause problems with the passwd
and group file
formats, such as :.
As for the problem with the shells, there is no risk because
save_user.cgi
does a check at line 90 to stop the user choosing a shell
that he is not
allowed to. All webmin modules (should) do this kind of
check as well..
Logged In: YES
user_id=222703
Limiting user and group names to word characters makes sense
to me - I want to impose the policy of user and group names
that cannot be mistaken for commands, preprocessing
instructions, etc. But, that's a philosophical point of
discussion.
The line 90 check for valid shells still doesn't meet my
security requirements. If the default access is left at
"*", the check is bypassed, and a user can modify a form and
submit it with a shell of /sbin/shutdown, for example. The
script should regenerate the list of valid shells from the
/etc/shells file, and check the input against these values.
O.T. - Any thought to incorporating Perl's CGI module to
help with form checking, etc.?
Logged In: YES
user_id=129364
Even without needing to modify the form you can choose an
arbitrary
shell though. Just select the Other option and enter
whatever you want into
the field below ..
It is true that someone could enter /sbin/shutdown, but it
wouldn't do anything
because it wouldn't be run as root. Always checking
/etc/shells is not the
best thing to do, because sometimes you do want to create a
user who has
a shell that is not in that file - a mail-only user for example.
As for using the CGI module, there is nothing to stop webmin
module
developers using it. The only reasons that webmin uses its
own ReadParse
function are that CGI was not a standard part of Perl when I
started
developing Webmin, and that I want to minimize the number of
module
dependencies for people who run Webmin on systems with
limited disk
space (such as embedded systems).