From 2aea28c4f955571d56fc69ef7104809b493c63ff Mon Sep 17 00:00:00 2001 From: Robert Scheck Date: Fri, 13 Feb 2015 01:06:54 +0100 Subject: [PATCH] Security fix to avoid arbitrary code execution when using Zarafa database user backend Without this patch the following works: - Set PLUGIN_PASSWD_USER_DEFAULT_ENABLE in passwd/config.php to true - Logon at Zarafa WebApp, go to "Settings", choose "Change Password" - Change the password successfully to e.g. "password; touch /tmp/abc" - Result: -rw-r--r--. 1 apache apache 0 Feb 13 01:06 /tmp/abc --- php/class.passwdmodule.php | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/php/class.passwdmodule.php b/php/class.passwdmodule.php index 1223940..cc1a842 100644 --- a/php/class.passwdmodule.php +++ b/php/class.passwdmodule.php @@ -165,8 +165,7 @@ class PasswdModule extends Module } /** - * Function will execute zarafa-passwd command and will try to change user's password, - * this method is unsecure and unreliable. + * Function will try to change user's password via MAPI in SOAP connection. * @param {Array} $data data sent by client. */ public function saveInDB($data) @@ -176,13 +175,11 @@ class PasswdModule extends Module $passwdRepeat = $data['new_password_repeat']; if($this->checkPasswordStrenth($passwd)) { - $passwd_cmd = '/usr/bin/zarafa-passwd -u %s -o %s -p %s'; - // all information correct, change password - $cmd = sprintf($passwd_cmd, $data['username'], $data['current_password'], $passwd); - exec($cmd, $arrayout, $retval); + $store = $GLOBALS['mapisession']->getDefaultMessageStore(); + $userinfo = mapi_zarafa_getuser_by_name($store, $data['username']); - if ($retval === 0) { + if (mapi_zarafa_setuser($store, $userinfo['userid'], $data['username'], $userinfo['fullname'], $userinfo['emailaddress'], $passwd, 0, $userinfo['admin'])) { // password changed successfully // write new password to session because we don't want user to re-authenticate