Bugzilla – Bug 1227203
VUL-0: CVE-2024-22033: obs-service-download_url: argument injection
Last modified: 2024-07-15 13:05:19 UTC
Thanks for that report! Please review my first attempt to solve this, need to think if there are further ways to inject a parameter tomorrow: https://github.com/openSUSE/obs-service-download_url/commit/54c08bf2d466ea5d55f77bb1185dab9018d9e5e8 just for the record, the services on our server are running in addition in containers, so we should not have a risk on our server. But it is definitive a problem because services are also executed on developer systems.
I'm giving a training today and tomorrow, so I can't look into this in detail. But I think this is not sufficient. Can you test your change with this change in the exploit: <param name="url"> --output-document=/srv/obs/service/.wgetrc</param> I assume the whitespace gets ignored upon execution. In general don't blacklist but whitelist allowed entries. Otherwise it's very tricky to get this right
indeed .. I modifed the code now to ensure that url is handled as single argument in any case. so any spaces can not be used anymore to prefix or hand over multiple arguments. https://github.com/openSUSE/obs-service-download_url/commit/d330e267997689eb8d2bc473f8d8b6c9a6a201ae
the whitelist would need to be always in sync with wget protocol support, so I'd like to avoid it.
So I can get the exploit still working with the current version. I suggest you add a sanity check for the URL and restrict it to strings starting with /http|ftp/i
k, I missed to solve it for url argument as well, but is supposed to be solved in git now. tagged as version 0.2.1 and ready to go out, when you give me the okay.
After the recent version I can't get it working anymore Please use CVE-2024-22033 for this
okay, releasing 0.2.1 now.
This is an autogenerated message for OBS integration: This bug (1227203) was mentioned in https://build.opensuse.org/request/show/1186878 Factory / obs-service-download_url https://build.opensuse.org/request/show/1186879 Backports:SLE-15-SP5 / obs-service-download_url https://build.opensuse.org/request/show/1186880 Backports:SLE-15-SP6 / obs-service-download_url
i rated it, but open for other input: 8 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Could also see CIA as L due to the sandboxing on the server and the fact that it runs with user privileges in a local context. But both are fine
openSUSE-SU-2024:0199-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1227203 CVE References: CVE-2024-22033 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): obs-service-download_url-0.2.1-bp155.3.3.1