[git.ipfire.org] IPFire 2.x development tree branch, master, updated. c9f577122c69dcdb8682cb03015f8b9f2b0874ac

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. c9f577122c69dcdb8682cb03015f8b9f2b0874ac

[Michael Tremer]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  c9f577122c69dcdb8682cb03015f8b9f2b0874ac (commit)
       via  2f97c9a22ce197f361dc02da13247ef0a807e969 (commit)
       via  35d45aad9c59e87fe60d2c66cb18dcd015960d71 (commit)
       via  f607f40952821ee52bdf28d34ba91bf95bdbc01f (commit)
      from  3bdac5995e4d2b9f1424e2df2b2b075915fa8b4c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c9f577122c69dcdb8682cb03015f8b9f2b0874ac
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Wed May 20 15:22:27 2026 +0000

    core202: Ship header.pl
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 2f97c9a22ce197f361dc02da13247ef0a807e969
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Wed May 20 16:15:44 2026 +0100

    sambactrl: Fix local priviledge escalation
    
    From the reporter:
       LPE in /usr/local/bin/sambactrl 'join' action
       File: src/misc-progs/sambactrl.c, lines 117-126.
       All other actions call is_valid_argument_alnum() on argv[2]. The
       'join' branch skips it entirely and feeds argv[2]/argv[3] into
       snprintf + safe_system (which is /bin/sh -c). Binary is installed
       -m 4750 -g nobody (src/misc-progs/Makefile:41), so any nobody-context
       process can invoke it and escalate to root.
    
    Reported-by: valent1 <gooads612@gmail.com>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 35d45aad9c59e87fe60d2c66cb18dcd015960d71
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Wed May 20 16:04:25 2026 +0100

    samba: Fix shell command execution vulnerability in join operation
    
    From the reporter:
    
       File: html/cgi-bin/samba.cgi, lines 96-98 and 790-798.
       joindomain() builds @options = ("/usr/local/bin/sambactrl","join",
       $username, $password) and runs qx(@options). In Perl, qx(@array)
       joins with $" and passes the result to /bin/sh -c. POST parameters
       USERNAME and PASSWORD reach this with no validation on the 'join'
       code path. RCE as the web user (nobody).
    
    Reported-by: valent1 <gooads612@gmail.com>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit f607f40952821ee52bdf28d34ba91bf95bdbc01f
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Wed May 20 16:00:33 2026 +0100

    header.pl: Escape titles for openbox()
    
    Reported-by: valent1 <gooads612@gmail.com>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/cfgroot/header.pl                  |  3 ++-
 config/rootfiles/core/202/filelists/files |  1 +
 html/cgi-bin/samba.cgi                    |  8 +++++---
 src/misc-progs/sambactrl.c                | 21 ++++++++++++++++++---
 4 files changed, 26 insertions(+), 7 deletions(-)

Difference in files:
diff --git a/config/cfgroot/header.pl b/config/cfgroot/header.pl
index 6e65f4137..a1a39bb4e 100644
--- a/config/cfgroot/header.pl
+++ b/config/cfgroot/header.pl
@@ -336,7 +336,8 @@ sub openbox {
 	my $width = shift;
 	my $align = shift;
 
-	my $title = shift;
+	# Escale the title
+	my $title = &Header::escape(shift);
 
 	my @classes = ("section", "is-box", @_);
 
diff --git a/config/rootfiles/core/202/filelists/files b/config/rootfiles/core/202/filelists/files
index 47b2a5a0b..dde5356f2 100644
--- a/config/rootfiles/core/202/filelists/files
+++ b/config/rootfiles/core/202/filelists/files
@@ -14,6 +14,7 @@ var/ipfire/backup/bin/backup.pl
 var/ipfire/backup/include
 var/ipfire/dns/dnsbl.json
 var/ipfire/general-functions.pl
+var/ipfire/header.pl
 var/ipfire/ipblocklist/sources
 var/ipfire/network-functions.pl
 var/ipfire/urlfilter/bin/autoupdate.pl
diff --git a/html/cgi-bin/samba.cgi b/html/cgi-bin/samba.cgi
index 5a23bf044..f3b092da8 100644
--- a/html/cgi-bin/samba.cgi
+++ b/html/cgi-bin/samba.cgi
@@ -791,8 +791,10 @@ sub joindomain {
 	my $username = shift;
 	my $password = shift;
 
-	my @options = ("/usr/local/bin/sambactrl", "join", $username, $password);
-	my $output = qx(@options);
+	my @output = &General::system_output(
+		"/usr/local/bin/sambactrl", "join", $username, $password,
+	);
 
-	return $output;
+	# Join together the output
+	return join("\n", @output);
 }
diff --git a/src/misc-progs/sambactrl.c b/src/misc-progs/sambactrl.c
index 38c26089c..11b0b4e01 100644
--- a/src/misc-progs/sambactrl.c
+++ b/src/misc-progs/sambactrl.c
@@ -11,6 +11,9 @@
 char command[BUFFER_SIZE];
 
 int main(int argc, char *argv[]) {
+	char who[BUFFER_SIZE];
+	int r;
+
 	if (!(initsetuid()))
 		exit(1);
 
@@ -116,9 +119,21 @@ int main(int argc, char *argv[]) {
 
 	} else if (strcmp(argv[1], "join") == 0) {
 		if (argc == 4) {
-			snprintf(command, BUFFER_SIZE - 1, "/usr/bin/net join -U \"%s%%%s\"",
-				argv[2], argv[3]);
-			return safe_system(command);
+			// Format who is joining
+			r = snprintf(who, sizeof(who), "%s%%%s", argv[2], argv[3]);
+			if (r < 0)
+				return r;
+
+			// Compose command line
+			char* args[] = {
+				"join",
+				"-U",
+				who,
+				NULL,
+			};
+
+			// Run the operation
+			return run("/usr/bin/net", args);
 		} else {
 			fprintf(stderr, "Wrong number of arguments. Need username and password.\n");
 			return 1;


hooks/post-receive
--
IPFire 2.x development tree