108822 - [security] Any user can change their groupset!

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect, P1)

Description

[Bradley Baetz (:bbaetz)]

userprefs.cgi has:

    SendSQL("UPDATE profiles SET mybugslink = '" . $::FORM{'mybugslink'} .
            "' WHERE userid = $userid");

playing with the mybugslink value on the form lets you do:

value="1', groupset='9223372036854775807"

It needs to be sqlescaped.

Comment 1

[Jacob Steenhagen]

Attachment: patch

Comment 2

[Jacob Steenhagen]

Yuck, that's nasty.  Once we get everything running in taint mode, it that'll be
a lot harder to do (because we'd have to validate it before we could pass it off
to the SQL server [running it through SqlQuote counts as validation]).

Comment 3

[Bradley Baetz (:bbaetz)]

Comment on attachment 56879 [details] [diff] [review]
patch

r=bbaetz. My exploit no longer works

Should we validate that its 0 or 1? The code only cares about 0 or !0.

Comment 4

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 56879 [details] [diff] [review]
patch

works.  r=myk

Comment 5

[Myk Melez [:myk] [@mykmelez]]

Checking in userprefs.cgi;
/cvsroot/mozilla/webtools/bugzilla/userprefs.cgi,v  <--  userprefs.cgi
new revision: 1.24; previous revision: 1.23
done

Comment 6

[Myk Melez [:myk] [@mykmelez]]

The patch has been checked in, so resolving fixed.

Comment 7

[Bradley Baetz (:bbaetz)]

test mail after bz update.

Comment 8

[Dave Miller [:justdave]]

This patch applied to the 2.14.1 branch with no changes.

/cvsroot/mozilla/webtools/bugzilla/userprefs.cgi,v  <--  userprefs.cgi
new revision: 1.20.2.1; previous revision: 1.20

Comment 9

[Dave Miller [:justdave]]

Hmm, it seems the bulk change thinks I'm not changing anything if all I do is
add names to the CC list, so I guess I have to make a comment.  Anyhow, adding
the representatives from the organizations we know of that support Bugzilla
distributions so they're aware of our upcoming security release

Comment 10

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Opening security bugs for which fixes have appeared in official bugzilla
release.  As per justdave and his posse.