852916 - LDAP Management: Possible Command Injection Vulnerability in adapters/postini.py

Status: VERIFIED FIXED

(Webtools Graveyard :: Phonebook, defect)

Description

[Frederik Braun [:freddy] (OOO until April 28th)]

This code that handles postini uses user-input in commands that
are being executed at system level. If the sanitation function can
be bypassed, attackers may compromise the whole system the Management
Interface runs on.

Instead of the current approach, I would advocate for using a different
command execution function that allows the seperation of the command
and its parameters, e.g. Popen.

My PoC exploit didn't work because I assume that the dev-server doesn't really use the postini bridge and I felt a bit hesitant to try my exploit on production just to proof a point :)

But I successfully registered a username with the email address <fbrau`sleep${IFS}5`[e-mail]>, which makes me quite confident we should fix this quickly.

Comment 1

[Rob Tucker [:rtucker]]

How did you inject the username fbrau`sleep${IFS}5`[e-mail] ? 

Did you do this by calling the PostiniUser direct from a python shell script or from the web interface?

Comment 2

[Frederik Braun [:freddy] (OOO until April 28th)]

I just added it from the web interface on ldap-dev.
See https://ldap-dev.allizom.org/manage/users/search/?search=secreview

Comment 3

[Rob Tucker [:rtucker]]

Attachment: Patch to use popen

Comment 4

[Rob Tucker [:rtucker]]

Attachment: Patch to use popen

Comment 5

[Frederik Braun [:freddy] (OOO until April 28th)]

Comment on attachment 727163 [details] [diff] [review]
Patch to use popen

Looks good!

Comment 6

[Frederik Braun [:freddy] (OOO until April 28th)]

This patch didn't fix all of the os.system() calls, but I talked to rtucker out of band and they are going to be checked in to the repo after my tests are completed.

Comment 7

[Rob Tucker [:rtucker]]

I've patched all of the os.system calls to use popen.

Can you confirm and then we can close.

Thanks again for everything!

Comment 8

[Frederik Braun [:freddy] (OOO until April 28th)]

Verified.