Skip to content

Commit cf7ee1b

Browse files
carlosmmatos-cscarlosmmatos-cs
committed
fix(security): stop curl_command from carrying the bearer token across a redirect
curl_command() passed -L, so a redirect was followed with the OAuth bearer token still on curl's configuration input. curl fixed the cross-host case in 7.58.0 as CVE-2018-1000007, which leaves roughly 7.30 through 7.57 exposed. Measured against the live API: every endpoint curl_command touches answers in a single hop on the correct region, including download-installer/v3 and the registry tags list. So -L never fired on a correct-region run. -L only did work when FALCON_CLOUD named the wrong region, because the API answers a wrong region with a 308 to the right one. That never worked on a curl that strips the header, which is every supported version: on curl 7.29.0 and 8.5.0 the redirect was followed, the header was dropped, the call came back 401 and the run died with a misleading "No sensor found for OS" error. The only versions where -L produced a working request are the same versions that leak the token. Dropped -L, and with it --proto-redir, keeping the convention from #521 that --proto-redir appears only next to -L. The wrong-region case is now handled the way the OAuth token request already handles it: the x-cs-region hint is adopted instead of the redirect being followed, so it works on every curl version rather than only the leaky band. The warning naming the real region still prints. falcon-container-sensor-pull.sh already adopted the hint; install, uninstall and migrate only warned and kept the wrong region. Fixes #523
1 parent dad81bf commit cf7ee1b

4 files changed

Lines changed: 27 additions & 17 deletions

File tree

‎bash/containers/falcon-container-sensor-pull/falcon-container-sensor-pull.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -291,12 +291,13 @@ curl_command() {
291291
# backslash or a double quote in the token has to be escaped first.
292292
escaped_token=$(printf '%s' "$token" | sed 's/\\/\\\\/g; s/"/\\"/g')
293293
auth_config=$(printf 'header = "Authorization: Bearer %s"' "$escaped_token")
294+
# No -L: the bearer token must never cross a redirect hop. The API corrects a
295+
# wrong region before this runs, and the registry answers in a single hop.
294296
printf '%s\n' "$auth_config" |
295-
curl -s -L --proto '=https' --proto-redir '=https' -K- "$@"
297+
curl -s --proto '=https' -K- "$@"
296298
}
297299

298300
fetch_tags() {
299-
# No -L, so --proto-redir is dropped too; nothing follows a redirect here.
300301
bearer_result=$(echo "-u $ART_USERNAME:$ART_PASSWORD" |
301302
curl -s --proto '=https' \
302303
"https://$cs_registry/v2/token?account=$ART_USERNAME&scope=repository:$registry_opts/$repository_name:pull&service=$cs_registry" -K-)

‎bash/install/falcon-linux-install.sh‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -710,8 +710,10 @@ curl_command() {
710710
# backslash or a double quote in the token has to be escaped first.
711711
escaped_token=$(printf '%s' "$cs_falcon_oauth_token" | sed 's/\\/\\\\/g; s/"/\\"/g')
712712
auth_config=$(printf 'header = "Authorization: Bearer %s"' "$escaped_token")
713+
# No -L: the bearer token must never cross a redirect hop. A wrong region is
714+
# corrected in get_oauth_token, so no call here needs to follow a redirect.
713715
printf '%s\n' "$auth_config" |
714-
curl -s -x "$proxy" -L --proto '=https' --proto-redir '=https' -K- "$@"
716+
curl -s -x "$proxy" --proto '=https' -K- "$@"
715717
}
716718

717719
check_aws_instance() {
@@ -829,10 +831,11 @@ get_oauth_token() {
829831
die "Unable to obtain region hint from CrowdStrike Falcon OAuth API, Please provide FALCON_CLOUD environment variable as an override."
830832
fi
831833
cs_falcon_cloud="${region_hint}"
832-
else
833-
if [ "${FALCON_CLOUD}" != "${region_hint}" ]; then
834-
echo "WARNING: FALCON_CLOUD='${FALCON_CLOUD}' environment variable specified while credentials only exists in '${region_hint}'" >&2
835-
fi
834+
elif [ -n "${region_hint}" ] && [ "${FALCON_CLOUD}" != "${region_hint}" ]; then
835+
echo "WARNING: FALCON_CLOUD='${FALCON_CLOUD}' environment variable specified while credentials only exists in '${region_hint}'" >&2
836+
# Use the hint. The API answers the wrong region with a redirect, which
837+
# curl_command no longer follows.
838+
cs_falcon_cloud="${region_hint}"
836839
fi
837840
fi
838841

‎bash/install/falcon-linux-uninstall.sh‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -256,8 +256,10 @@ curl_command() {
256256
# backslash or a double quote in the token has to be escaped first.
257257
escaped_token=$(printf '%s' "$cs_falcon_oauth_token" | sed 's/\\/\\\\/g; s/"/\\"/g')
258258
auth_config=$(printf 'header = "Authorization: Bearer %s"' "$escaped_token")
259+
# No -L: the bearer token must never cross a redirect hop. A wrong region is
260+
# corrected in get_oauth_token, so no call here needs to follow a redirect.
259261
printf '%s\n' "$auth_config" |
260-
curl -s -x "$proxy" -L --proto '=https' --proto-redir '=https' -K- "$@"
262+
curl -s -x "$proxy" --proto '=https' -K- "$@"
261263
}
262264

263265
handle_curl_error() {
@@ -490,10 +492,11 @@ get_oauth_token() {
490492
die "Unable to obtain region hint from CrowdStrike Falcon OAuth API, Please provide FALCON_CLOUD environment variable as an override."
491493
fi
492494
cs_falcon_cloud="${region_hint}"
493-
else
494-
if [ "${FALCON_CLOUD}" != "${region_hint}" ]; then
495-
echo "WARNING: FALCON_CLOUD='${FALCON_CLOUD}' environment variable specified while credentials only exists in '${region_hint}'" >&2
496-
fi
495+
elif [ -n "${region_hint}" ] && [ "${FALCON_CLOUD}" != "${region_hint}" ]; then
496+
echo "WARNING: FALCON_CLOUD='${FALCON_CLOUD}' environment variable specified while credentials only exists in '${region_hint}'" >&2
497+
# Use the hint. The API answers the wrong region with a redirect, which
498+
# curl_command no longer follows.
499+
cs_falcon_cloud="${region_hint}"
497500
fi
498501
fi
499502

‎bash/migrate/falcon-linux-migrate.sh‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -234,8 +234,10 @@ curl_command() {
234234
# backslash or a double quote in the token has to be escaped first.
235235
escaped_token=$(printf '%s' "$cs_falcon_oauth_token" | sed 's/\\/\\\\/g; s/"/\\"/g')
236236
auth_config=$(printf 'header = "Authorization: Bearer %s"' "$escaped_token")
237+
# No -L: the bearer token must never cross a redirect hop. A wrong region is
238+
# corrected in get_oauth_token, so no call here needs to follow a redirect.
237239
printf '%s\n' "$auth_config" |
238-
curl -s -x "$proxy" -L --proto '=https' --proto-redir '=https' -K- "$@"
240+
curl -s -x "$proxy" --proto '=https' -K- "$@"
239241
}
240242

241243
handle_curl_error() {
@@ -409,10 +411,11 @@ get_oauth_token() {
409411
die "Unable to obtain region hint from CrowdStrike Falcon OAuth API, Please provide FALCON_CLOUD environment variable as an override."
410412
fi
411413
cs_falcon_cloud="${region_hint}"
412-
else
413-
if [ "${FALCON_CLOUD}" != "${region_hint}" ]; then
414-
echo "WARNING: FALCON_CLOUD='${FALCON_CLOUD}' environment variable specified while credentials only exists in '${region_hint}'" >&2
415-
fi
414+
elif [ -n "${region_hint}" ] && [ "${FALCON_CLOUD}" != "${region_hint}" ]; then
415+
echo "WARNING: FALCON_CLOUD='${FALCON_CLOUD}' environment variable specified while credentials only exists in '${region_hint}'" >&2
416+
# Use the hint. The API answers the wrong region with a redirect, which
417+
# curl_command no longer follows.
418+
cs_falcon_cloud="${region_hint}"
416419
fi
417420
fi
418421

0 commit comments

Comments
 (0)