ston1th/zarafa-webapp-passwd
1
0
Fork 0
mirror of https://github.com/silentsakky/zarafa-webapp-passwd synced 2026-08-06 15:31:29 +02:00
Code Releases Activity

Security fix to avoid arbitrary code execution when using Zarafa database user backend

Browse source 
Without this patch the following works:
- Set PLUGIN_PASSWD_USER_DEFAULT_ENABLE in passwd/config.php to true
- Logon at Zarafa WebApp, go to "Settings", choose "Change Password"
- Change the password successfully to e.g. "password; touch /tmp/abc"
- Result: -rw-r--r--. 1 apache apache 0 Feb 13 01:06 /tmp/abc
This commit is contained in:
Robert Scheck 2015-02-13 01:06:54 +01:00
commit 2aea28c4f9
1 changed files with 4 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

11
php/class.passwdmodule.php
View file

@ -165,8 +165,7 @@ class PasswdModule extends Module
} }
/** /**
* Function will execute zarafa-passwd command and will try to change user's password, * Function will try to change user's password via MAPI in SOAP connection.
* this method is unsecure and unreliable.
* @param {Array} $data data sent by client. * @param {Array} $data data sent by client.
*/ */
public function saveInDB($data) public function saveInDB($data)
@ -176,13 +175,11 @@ class PasswdModule extends Module
$passwdRepeat = $data['new_password_repeat']; $passwdRepeat = $data['new_password_repeat'];
if($this->checkPasswordStrenth($passwd)) { if($this->checkPasswordStrenth($passwd)) {
$passwd_cmd = '/usr/bin/zarafa-passwd -u %s -o %s -p %s';
// all information correct, change password // all information correct, change password
$cmd = sprintf($passwd_cmd, $data['username'], $data['current_password'], $passwd); $store = $GLOBALS['mapisession']->getDefaultMessageStore();
exec($cmd, $arrayout, $retval); $userinfo = mapi_zarafa_getuser_by_name($store, $data['username']);
if ($retval === 0) { if (mapi_zarafa_setuser($store, $userinfo['userid'], $data['username'], $userinfo['fullname'], $userinfo['emailaddress'], $passwd, 0, $userinfo['admin'])) {
// password changed successfully // password changed successfully
// write new password to session because we don't want user to re-authenticate // write new password to session because we don't want user to re-authenticate