219044 - MySQL injection vulnerability in editkeywords.cgi

Status: RESOLVED FIXED

(Bugzilla :: Administration, task)

Description

[Vlad Dascalu]

Any user with the editkeywords priv can do MySQL injection attacks and find out
confidential information using direct access to the Bugzilla database.

For example, by clicking the URL of this bug,

http://bugzilla.mozilla.org/editkeywords.cgi?action=edit&id=1234567+union+select+login_name,cryptpassword+from+profiles

someone can find out the username and the cryptpassword of a user.

The issue is that the "ID" field is not validated before it's passed to the
SendSQL subroutine.

Comment 1

[Vlad Dascalu]

So a patch needs to be written againest the 2.16 branch.

What about a patch againest CVS Head? Are we waiting for the admin rewrite
thing, or it's worth fixing before that?

Comment 2

[Dave Miller [:justdave]]

I'd just as soon do the rewrite (which I expect to happen soon) for 2.17. 
That's why I put 2.17.6 on it instead of 2.17.5

Comment 3

[Joel Peshkin]

Attachment: Patch (both branches)

All we need to do is detain_natural the id

Comment 4

[Dave Miller [:justdave]]

Comment on attachment 134158 [details] [diff] [review]
Patch (both branches)

Patch applies cleanly to both branches.  Seems to do the trick.  Gives me
"Something screwy is going on here, please try again"

Comment 5

[Zach Lipton [:zach]]

Comment on attachment 134158 [details] [diff] [review]
Patch (both branches)

r=zach

Comment 6

[Dave Miller [:justdave]]

-> Patch author

Comment 7

[Dave Miller [:justdave]]

Checked in on trunk:

Checking in editkeywords.cgi;
/cvsroot/mozilla/webtools/bugzilla/editkeywords.cgi,v  <--  editkeywords.cgi
new revision: 1.16; previous revision: 1.15
done

Comment 8

[Dave Miller [:justdave]]

Checked in on 2.16 branch:

Checking in editkeywords.cgi;
/cvsroot/mozilla/webtools/bugzilla/editkeywords.cgi,v  <--  editkeywords.cgi
new revision: 1.9.2.2; previous revision: 1.9.2.1
done

Comment 9

[Dave Miller [:justdave]]

Security advisory has been posted.