bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sanitize file name received from Content-Disposition header

Browse source 
When installing a remote package with "pacman -U <url>", pacman renames
the downloaded package file to match the name given in the
Content-Disposition header. However, pacman does not sanitize this name,
which may contain slashes, before calling rename(). A malicious server (or
a network MitM if downloading over HTTP) can send a content-disposition
header to make pacman place the file anywhere in the filesystem,
potentially leading to arbitrary root code execution. Notably, this
bypasses pacman's package signature checking.

For example, a malicious package-hosting server (or a network
man-in-the-middle, if downloading over HTTP) could serve the following
header:

Content-Disposition: filename=../../../../../../usr/share/libalpm/hooks/evil.hook

and pacman would move the downloaded file to
/usr/share/libalpm/hooks/evil.hook. This invocation of "pacman -U" would
later fail, unable to find the downloaded package in the cache directory,
but the hook file would remain in place. The commands in the malicious
hook would then be run (as root) the next time any package is installed.

Discovered-by: Adam Suhl <asuhl@mit.edu>
Signed-off-by: Allan McRae <allan@archlinux.org>
This commit is contained in:
Andrew Gregory 2019-03-01 11:23:20 +10:00 • committed by Allan McRae
parent adb961a88e
commit d197d8ab82
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/libalpm/dload.c
View file

@ -535,7 +535,8 @@ static int curl_download_internal(struct dload_payload *payload,
if(payload->content_disp_name) { if(payload->content_disp_name) {
/* content-disposition header has a better name for our file */ /* content-disposition header has a better name for our file */
free(payload->destfile_name); free(payload->destfile_name);
payload->destfile_name = get_fullpath(localpath, payload->content_disp_name, ""); payload->destfile_name = get_fullpath(localpath,
get_filename(payload->content_disp_name), "");
} else { } else {
const char *effective_filename = strrchr(effective_url, '/'); const char *effective_filename = strrchr(effective_url, '/');
if(effective_filename && strlen(effective_filename) > 2) { if(effective_filename && strlen(effective_filename) > 2) {