Summary
An authenticated user can bypass the OOD file browser allowlist (OOD_ALLOWLIST_PATH) when downloading directories as zip files. The allowlist is checked for all files before any zipping happens, which allows modifications to already validated files, such as replacing files with symlinks.
Details
The allowlist is checked in PosixFile, but the actual reading of files happens later, in FilesController.
Since the files seem to be processed in alphabetical order, intentionally causing delays to increase the time window for file replacement is trivial. When reading the files for zipping, symlinks are dereferenced without any validation against the allowlist.
PoC
To reproduce:
- Configure the allowlist, e.g. OOD_ALLOWLIST_PATH: "/home"
- Prepare the directory to download:
mkdir dir
# Create a larger file to intentionally cause a delay in the processing of the files to zip
dd if=/dev/random of=dir/big_file bs=10M count=10
touch dir/file_to_replace
- Start a download of the directory in OOD file browser.
- Immediately replace file_to_replace with a symlink to your target file (using dnf.log as an example): ln -sf /var/log/dnf.log dir/file_to_replace. Note that the name of the symlink must be alphabetically after the name of the large file to be processed later.
- The file_to_replace file in the downloaded zip now contains the contents of /var/log/dnf.log on the OOD server.
Impact
This vulnerability impacts sites that use the file browser allowlists in all current versions of OOD. However, files accessed are still protected by the UNIX permissions.
robinkar Reporter
Summary
An authenticated user can bypass the OOD file browser allowlist (OOD_ALLOWLIST_PATH) when downloading directories as zip files. The allowlist is checked for all files before any zipping happens, which allows modifications to already validated files, such as replacing files with symlinks.
Details
The allowlist is checked in PosixFile, but the actual reading of files happens later, in FilesController.
Since the files seem to be processed in alphabetical order, intentionally causing delays to increase the time window for file replacement is trivial. When reading the files for zipping, symlinks are dereferenced without any validation against the allowlist.
PoC
To reproduce:
Impact
This vulnerability impacts sites that use the file browser allowlists in all current versions of OOD. However, files accessed are still protected by the UNIX permissions.