From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gLFfF03zBz2xSM for ; Wed, 20 May 2026 15:22:45 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gLFfD70H6z2xHN for ; Wed, 20 May 2026 15:22:44 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gLFfD400NzCj for ; Wed, 20 May 2026 15:22:44 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1779290564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=W3NorYQDS435mZY0pMztfjvxAYn8+bEms8J6zOAaPJw=; b=HWb9BNyaNwUOJLdfLFPFB3C/ssM/48Uz3hlJ56CA/pNGcucabix4cWBy4fKUe24uhruRnC L2gWLmnEQC+zZMCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1779290564; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=W3NorYQDS435mZY0pMztfjvxAYn8+bEms8J6zOAaPJw=; b=Bsmbaa2PV8x40nx1gVwUcnrtMt6p3AeapHN7/OwGjQDXk83rbA8x8x3WjuZ8oZ3wODUXKY /jnZ9CNZNCaT3ZoySydziTNn94090Zi3BBNMLh9KwwSHkr1xbHn3GW+cCrtojK2NNQXbta ZyBiWCEYWDjbTrbw0GWLJLqoPMtoEwInMwAuaRz460ePhEK8bhixn9u9zS8f7RIYrRP/xy broU9JQjXmNnwLRCI5XJV7MhaGKTAqjHS4ZuGBnLnyzC7RYfkxTRC67glTT4pyAYSgyqZY DGmxTMpCM4QZNlpLDaXDOf/qYVtmcc9QezogaFx+sMJOHZehkjS0R6t8l+qq7A== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4gLFfD3W5Nz2xQd; Wed, 20 May 2026 15:22:44 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, master, updated. c9f577122c69dcdb8682cb03015f8b9f2b0874ac X-Git-Refname: refs/heads/master X-Git-Reftype: branch X-Git-Oldrev: 3bdac5995e4d2b9f1424e2df2b2b075915fa8b4c X-Git-Newrev: c9f577122c69dcdb8682cb03015f8b9f2b0874ac Message-Id: <4gLFfD3W5Nz2xQd@people01.haj.ipfire.org> Date: Wed, 20 May 2026 15:22:44 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via c9f577122c69dcdb8682cb03015f8b9f2b0874ac (commit) via 2f97c9a22ce197f361dc02da13247ef0a807e969 (commit) via 35d45aad9c59e87fe60d2c66cb18dcd015960d71 (commit) via f607f40952821ee52bdf28d34ba91bf95bdbc01f (commit) from 3bdac5995e4d2b9f1424e2df2b2b075915fa8b4c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c9f577122c69dcdb8682cb03015f8b9f2b0874ac Author: Michael Tremer Date: Wed May 20 15:22:27 2026 +0000 core202: Ship header.pl Signed-off-by: Michael Tremer commit 2f97c9a22ce197f361dc02da13247ef0a807e969 Author: Michael Tremer Date: Wed May 20 16:15:44 2026 +0100 sambactrl: Fix local priviledge escalation From the reporter: LPE in /usr/local/bin/sambactrl 'join' action File: src/misc-progs/sambactrl.c, lines 117-126. All other actions call is_valid_argument_alnum() on argv[2]. The 'join' branch skips it entirely and feeds argv[2]/argv[3] into snprintf + safe_system (which is /bin/sh -c). Binary is installed -m 4750 -g nobody (src/misc-progs/Makefile:41), so any nobody-context process can invoke it and escalate to root. Reported-by: valent1 Signed-off-by: Michael Tremer commit 35d45aad9c59e87fe60d2c66cb18dcd015960d71 Author: Michael Tremer Date: Wed May 20 16:04:25 2026 +0100 samba: Fix shell command execution vulnerability in join operation From the reporter: File: html/cgi-bin/samba.cgi, lines 96-98 and 790-798. joindomain() builds @options = ("/usr/local/bin/sambactrl","join", $username, $password) and runs qx(@options). In Perl, qx(@array) joins with $" and passes the result to /bin/sh -c. POST parameters USERNAME and PASSWORD reach this with no validation on the 'join' code path. RCE as the web user (nobody). Reported-by: valent1 Signed-off-by: Michael Tremer commit f607f40952821ee52bdf28d34ba91bf95bdbc01f Author: Michael Tremer Date: Wed May 20 16:00:33 2026 +0100 header.pl: Escape titles for openbox() Reported-by: valent1 Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/cfgroot/header.pl | 3 ++- config/rootfiles/core/202/filelists/files | 1 + html/cgi-bin/samba.cgi | 8 +++++--- src/misc-progs/sambactrl.c | 21 ++++++++++++++++++--- 4 files changed, 26 insertions(+), 7 deletions(-) Difference in files: diff --git a/config/cfgroot/header.pl b/config/cfgroot/header.pl index 6e65f4137..a1a39bb4e 100644 --- a/config/cfgroot/header.pl +++ b/config/cfgroot/header.pl @@ -336,7 +336,8 @@ sub openbox { my $width = shift; my $align = shift; - my $title = shift; + # Escale the title + my $title = &Header::escape(shift); my @classes = ("section", "is-box", @_); diff --git a/config/rootfiles/core/202/filelists/files b/config/rootfiles/core/202/filelists/files index 47b2a5a0b..dde5356f2 100644 --- a/config/rootfiles/core/202/filelists/files +++ b/config/rootfiles/core/202/filelists/files @@ -14,6 +14,7 @@ var/ipfire/backup/bin/backup.pl var/ipfire/backup/include var/ipfire/dns/dnsbl.json var/ipfire/general-functions.pl +var/ipfire/header.pl var/ipfire/ipblocklist/sources var/ipfire/network-functions.pl var/ipfire/urlfilter/bin/autoupdate.pl diff --git a/html/cgi-bin/samba.cgi b/html/cgi-bin/samba.cgi index 5a23bf044..f3b092da8 100644 --- a/html/cgi-bin/samba.cgi +++ b/html/cgi-bin/samba.cgi @@ -791,8 +791,10 @@ sub joindomain { my $username = shift; my $password = shift; - my @options = ("/usr/local/bin/sambactrl", "join", $username, $password); - my $output = qx(@options); + my @output = &General::system_output( + "/usr/local/bin/sambactrl", "join", $username, $password, + ); - return $output; + # Join together the output + return join("\n", @output); } diff --git a/src/misc-progs/sambactrl.c b/src/misc-progs/sambactrl.c index 38c26089c..11b0b4e01 100644 --- a/src/misc-progs/sambactrl.c +++ b/src/misc-progs/sambactrl.c @@ -11,6 +11,9 @@ char command[BUFFER_SIZE]; int main(int argc, char *argv[]) { + char who[BUFFER_SIZE]; + int r; + if (!(initsetuid())) exit(1); @@ -116,9 +119,21 @@ int main(int argc, char *argv[]) { } else if (strcmp(argv[1], "join") == 0) { if (argc == 4) { - snprintf(command, BUFFER_SIZE - 1, "/usr/bin/net join -U \"%s%%%s\"", - argv[2], argv[3]); - return safe_system(command); + // Format who is joining + r = snprintf(who, sizeof(who), "%s%%%s", argv[2], argv[3]); + if (r < 0) + return r; + + // Compose command line + char* args[] = { + "join", + "-U", + who, + NULL, + }; + + // Run the operation + return run("/usr/bin/net", args); } else { fprintf(stderr, "Wrong number of arguments. Need username and password.\n"); return 1; hooks/post-receive -- IPFire 2.x development tree