opensourcemirror
/
ipfire-2.x
mirror of git://git.ipfire.org/ipfire-2.x.git
1
0
Fork 0
Code Issues Releases Wiki Activity

proxy.cgi: Correctly validate domain lists 

Fixes: #12925 - JVN#15411362 Inquiry on vulnerability found in IPFire
Reported-by: Noriko Totsuka <vuls@jpcert.or.jp>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
This commit is contained in:
Michael Tremer 2022-09-06 14:15:54 +02:00 committed by Peter Müller
parent 7cb63527d9
commit ba4f53c565
4 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
config/cfgroot/general-functions.pl
View File

@ -756,6 +756,17 @@ sub validdomainname
return 1;
}
sub validwildcarddomainname($) {
my $domainname = shift;
# Ignore any leading dots
if ($domainname =~ m/^\*\.(.*)/) {
$domainname = $1;
}
return &validdomainname($domainname);
}
sub validfqdn
{
# Checks a fully qualified domain name against RFC1035 and RFC2181

2
html/cgi-bin/proxy.cgi
View File

@ -2506,6 +2506,7 @@ sub check_acls
if ($_)
{
if (/^\./) { $_ = '*'.$_; }
unless (&General::validwildcarddomainname($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid url'} . ": " . &Header::escape($_); }
$proxysettings{'DST_NOCACHE'} .= $_."\n";
}
}
@ -2604,6 +2605,7 @@ sub check_acls
if ($_)
{
if (/^\./) { $_ = '*'.$_; }
unless (&General::validwildcarddomainname($_)) { $errormessage = $Lang::tr{'advproxy errmsg invalid url'} . ": " . &Header::escape($_); }
$proxysettings{'DST_NOPROXY_URL'} .= $_."\n";
}
}

1
langs/de/cgi-bin/de.pl
View File

@ -301,6 +301,7 @@
'advproxy errmsg invalid proxy port' => 'Ungültiger Proxyport',
'advproxy errmsg invalid upstream proxy' => 'Ungültige IP/Hostname für vorgelagerten Proxy',
'advproxy errmsg invalid upstream proxy username or password setting' => 'Ungültiger Benutzername oder ungültiges Kennwort für vorgelagerten Proxy',
'advproxy errmsg invalid url' => 'Ungültige URL',
'advproxy errmsg invalid user' => 'Benutzername existiert nicht',
'advproxy errmsg ldap base dn' => 'LDAP Base DN erforderlich',
'advproxy errmsg ldap bind dn' => 'LDAP Bind DN Benutzername und Passwort erforderlich',

1
langs/en/cgi-bin/en.pl
View File

@ -298,6 +298,7 @@
'advproxy errmsg invalid proxy port' => 'Invalid proxy port',
'advproxy errmsg invalid upstream proxy' => 'Invalid upstream proxy IP/hostname',
'advproxy errmsg invalid upstream proxy username or password setting' => 'Invalid upstream proxy username or password setting',
'advproxy errmsg invalid url' => 'Invalid URL',
'advproxy errmsg invalid user' => 'Username does not exist',
'advproxy errmsg ldap base dn' => 'LDAP base DN required',
'advproxy errmsg ldap bind dn' => 'LDAP bind DN username and password required',