diff options
| author | Corey Farrell <git@cfware.com> | 2017-07-01 20:24:27 -0400 |
|---|---|---|
| committer | Joshua Colp <jcolp@digium.com> | 2017-08-30 18:42:30 +0000 |
| commit | 9c20596400cef759ecc760e1b028fd1748e9be5d (patch) | |
| tree | 13f6e29e3fa0cd10088505afc62b035f537b1b92 /README-SERIOUSLY.bestpractices.txt | |
| parent | b96306e3a680f04b3bdce69892f82b61891aed27 (diff) | |
AST-2017-006: Fix app_minivm application MinivmNotify command injection
An admin can configure app_minivm with an externnotify program to be run
when a voicemail is received. The app_minivm application MinivmNotify
uses ast_safe_system() for this purpose which is vulnerable to command
injection since the Caller-ID name and number values given to externnotify
can come from an external untrusted source.
* Add ast_safe_execvp() function. This gives modules the ability to run
external commands with greater safety compared to ast_safe_system().
Specifically when some parameters are filled by untrusted sources the new
function does not allow malicious input to break argument encoding. This
may be of particular concern where CALLERID(name) or CALLERID(num) may be
used as a parameter to a script run by ast_safe_system() which could
potentially allow arbitrary command execution.
* Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp()
instead of ast_safe_system() to avoid command injection.
* Document code injection potential from untrusted data sources for other
shell commands that are under user control.
ASTERISK-27103
Change-Id: I7552472247a84cde24e1358aaf64af160107aef1
Diffstat (limited to 'README-SERIOUSLY.bestpractices.txt')
| -rw-r--r-- | README-SERIOUSLY.bestpractices.txt | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/README-SERIOUSLY.bestpractices.txt b/README-SERIOUSLY.bestpractices.txt index b6b418d9f..0d3e670cf 100644 --- a/README-SERIOUSLY.bestpractices.txt +++ b/README-SERIOUSLY.bestpractices.txt @@ -94,6 +94,13 @@ your ITSP in a place where you didn't expect to allow it. There are a couple of ways in which you can mitigate this impact: stricter pattern matching, or using the FILTER() dialplan function. +The CALLERID(num) and CALLERID(name) values are other commonly used values that +are sources of data potentially supplied by outside sources. If you use these +values as parameters to the System(), MixMonitor(), or Monitor() applications +or the SHELL() dialplan function, you can allow injection of arbitrary operating +system command execution. The FILTER() dialplan function is available to remove +dangerous characters from untrusted strings to block the command injection. + Strict Pattern Matching ----------------------- |