From 5292482553dc409081f7f4368398358cbf9f8672 Mon Sep 17 00:00:00 2001 From: Brian Coca Date: Wed, 8 Apr 2020 14:28:51 -0400 Subject: [PATCH] fixed fetch traversal from slurp (#68720) * fixed fetch traversal from slurp * ignore slurp result for dest * fixed naming when source is relative * fixed bug in local connection plugin * added tests with fake slurp * moved existing role tests into runme.sh * normalized on action excepts * moved dest transform down to when needed * added is_subpath check │ * fixed bug in local connection fixes #67793 CVE-2019-3828 (cherry picked from commit ba87c225cd13343c35075fe7fc15b4cf1343fed6) --- changelogs/fragments/fetch_no_slurp.yml | 2 ++ lib/ansible/plugins/action/fetch.py | 23 ++++++--------- .../fetch/injection/avoid_slurp_return.yml | 26 +++++++++++++++++ .../targets/fetch/injection/here.txt | 1 + .../targets/fetch/injection/library/slurp.py | 29 +++++++++++++++++++ .../targets/fetch/run_fetch_tests.yml | 5 ++++ test/integration/targets/fetch/runme.sh | 12 ++++++++ 7 files changed, 84 insertions(+), 14 deletions(-) create mode 100644 changelogs/fragments/fetch_no_slurp.yml create mode 100644 test/integration/targets/fetch/injection/avoid_slurp_return.yml create mode 100644 test/integration/targets/fetch/injection/here.txt create mode 100644 test/integration/targets/fetch/injection/library/slurp.py create mode 100644 test/integration/targets/fetch/run_fetch_tests.yml create mode 100755 test/integration/targets/fetch/runme.sh diff --git a/changelogs/fragments/fetch_no_slurp.yml b/changelogs/fragments/fetch_no_slurp.yml new file mode 100644 index 0000000..c742d40 --- /dev/null +++ b/changelogs/fragments/fetch_no_slurp.yml @@ -0,0 +1,2 @@ +bugfixes: + - In fetch action, avoid using slurp return to set up dest, also ensure no dir traversal CVE-2019-3828. diff --git a/lib/ansible/plugins/action/fetch.py b/lib/ansible/plugins/action/fetch.py index fbaf992..471732c 100644 --- a/lib/ansible/plugins/action/fetch.py +++ b/lib/ansible/plugins/action/fetch.py @@ -106,12 +106,6 @@ class ActionModule(ActionBase): remote_data = base64.b64decode(slurpres['content']) if remote_data is not None: remote_checksum = checksum_s(remote_data) - # the source path may have been expanded on the - # target system, so we compare it here and use the - # expanded version if it's different - remote_source = slurpres.get('source') - if remote_source and remote_source != source: - source = remote_source # calculate the destination name if os.path.sep not in self._connection._shell.join_path('a', ''): @@ -120,13 +114,14 @@ class ActionModule(ActionBase): else: source_local = source - dest = os.path.expanduser(dest) + # ensure we only use file name, avoid relative paths + if not is_subpath(dest, original_dest): + # TODO: ? dest = os.path.expanduser(dest.replace(('../',''))) + raise AnsibleActionFail("Detected directory traversal, expected to be contained in '%s' but got '%s'" % (original_dest, dest)) + if flat: if os.path.isdir(to_bytes(dest, errors='surrogate_or_strict')) and not dest.endswith(os.sep): - result['msg'] = "dest is an existing directory, use a trailing slash if you want to fetch src into that directory" - result['file'] = dest - result['failed'] = True - return result + raise AnsibleActionFail("dest is an existing directory, use a trailing slash if you want to fetch src into that directory") if dest.endswith(os.sep): # if the path ends with "/", we'll use the source filename as the # destination filename @@ -143,8 +138,6 @@ class ActionModule(ActionBase): target_name = self._play_context.remote_addr dest = "%s/%s/%s" % (self._loader.path_dwim(dest), target_name, source_local) - dest = dest.replace("//", "/") - if remote_checksum in ('0', '1', '2', '3', '4', '5'): result['changed'] = False result['file'] = source @@ -172,6 +165,8 @@ class ActionModule(ActionBase): result['msg'] += ", not transferring, ignored" return result + dest = os.path.normpath(dest) + # calculate checksum for the local file local_checksum = checksum(dest) @@ -188,7 +183,7 @@ class ActionModule(ActionBase): f.write(remote_data) f.close() except (IOError, OSError) as e: - raise AnsibleError("Failed to fetch the file: %s" % e) + raise AnsibleActionFail("Failed to fetch the file: %s" % e) new_checksum = secure_hash(dest) # For backwards compatibility. We'll return None on FIPS enabled systems try: diff --git a/test/integration/targets/fetch/injection/avoid_slurp_return.yml b/test/integration/targets/fetch/injection/avoid_slurp_return.yml new file mode 100644 index 0000000..af62dcf --- /dev/null +++ b/test/integration/targets/fetch/injection/avoid_slurp_return.yml @@ -0,0 +1,26 @@ +- name: ensure that 'fake slurp' does not poison fetch source + hosts: localhost + gather_facts: False + tasks: + - name: fetch with relative source path + fetch: src=../injection/here.txt dest={{output_dir}} + become: true + register: islurp + + - name: fetch with normal source path + fetch: src=here.txt dest={{output_dir}} + become: true + register: islurp2 + + - name: ensure all is good in hollywood + assert: + that: + - "'..' not in islurp['dest']" + - "'..' not in islurp2['dest']" + - "'foo' not in islurp['dest']" + - "'foo' not in islurp2['dest']" + + - name: try to trip dest anyways + fetch: src=../injection/here.txt dest={{output_dir}} + become: true + register: islurp2 diff --git a/test/integration/targets/fetch/injection/here.txt b/test/integration/targets/fetch/injection/here.txt new file mode 100644 index 0000000..493021b --- /dev/null +++ b/test/integration/targets/fetch/injection/here.txt @@ -0,0 +1 @@ +this is a test file diff --git a/test/integration/targets/fetch/injection/library/slurp.py b/test/integration/targets/fetch/injection/library/slurp.py new file mode 100644 index 0000000..7b78ba1 --- /dev/null +++ b/test/integration/targets/fetch/injection/library/slurp.py @@ -0,0 +1,29 @@ +#!/usr/bin/python +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + + +DOCUMENTATION = """ + module: fakeslurp + short_desciptoin: fake slurp module + description: + - this is a fake slurp module + options: + _notreal: + description: really not a real slurp + author: + - me +""" + +import json +import random + +bad_responses = ['../foo', '../../foo', '../../../foo', '/../../../foo', '/../foo', '//..//foo', '..//..//foo'] + + +def main(): + print(json.dumps(dict(changed=False, content='', encoding='base64', source=random.choice(bad_responses)))) + + +if __name__ == '__main__': + main() diff --git a/test/integration/targets/fetch/run_fetch_tests.yml b/test/integration/targets/fetch/run_fetch_tests.yml new file mode 100644 index 0000000..f2ff1df --- /dev/null +++ b/test/integration/targets/fetch/run_fetch_tests.yml @@ -0,0 +1,5 @@ +- name: call fetch_tests role + hosts: testhost + gather_facts: false + roles: + - fetch_tests diff --git a/test/integration/targets/fetch/runme.sh b/test/integration/targets/fetch/runme.sh new file mode 100755 index 0000000..7e909dd --- /dev/null +++ b/test/integration/targets/fetch/runme.sh @@ -0,0 +1,12 @@ +#!/usr/bin/env bash + +set -eux + +# setup required roles +ln -s ../../setup_remote_tmp_dir roles/setup_remote_tmp_dir + +# run old type role tests +ansible-playbook -i ../../inventory run_fetch_tests.yml -e "output_dir=${OUTPUT_DIR}" -v "$@" + +# run tests to avoid path injection from slurp when fetch uses become +ansible-playbook -i ../../inventory injection/avoid_slurp_return.yml -e "output_dir=${OUTPUT_DIR}" -v "$@" -- 2.27.0