216 lines
8.4 KiB
Diff
216 lines
8.4 KiB
Diff
From 5292482553dc409081f7f4368398358cbf9f8672 Mon Sep 17 00:00:00 2001
|
|
From: Brian Coca <bcoca@users.noreply.github.com>
|
|
Date: Wed, 8 Apr 2020 14:28:51 -0400
|
|
Subject: [PATCH] fixed fetch traversal from slurp (#68720)
|
|
|
|
* fixed fetch traversal from slurp
|
|
|
|
* ignore slurp result for dest
|
|
* fixed naming when source is relative
|
|
* fixed bug in local connection plugin
|
|
* added tests with fake slurp
|
|
* moved existing role tests into runme.sh
|
|
* normalized on action excepts
|
|
* moved dest transform down to when needed
|
|
* added is_subpath check
|
|
│ * fixed bug in local connection
|
|
fixes #67793
|
|
|
|
CVE-2019-3828
|
|
|
|
(cherry picked from commit ba87c225cd13343c35075fe7fc15b4cf1343fed6)
|
|
---
|
|
changelogs/fragments/fetch_no_slurp.yml | 2 ++
|
|
lib/ansible/plugins/action/fetch.py | 23 ++++++---------
|
|
.../fetch/injection/avoid_slurp_return.yml | 26 +++++++++++++++++
|
|
.../targets/fetch/injection/here.txt | 1 +
|
|
.../targets/fetch/injection/library/slurp.py | 29 +++++++++++++++++++
|
|
.../targets/fetch/run_fetch_tests.yml | 5 ++++
|
|
test/integration/targets/fetch/runme.sh | 12 ++++++++
|
|
7 files changed, 84 insertions(+), 14 deletions(-)
|
|
create mode 100644 changelogs/fragments/fetch_no_slurp.yml
|
|
create mode 100644 test/integration/targets/fetch/injection/avoid_slurp_return.yml
|
|
create mode 100644 test/integration/targets/fetch/injection/here.txt
|
|
create mode 100644 test/integration/targets/fetch/injection/library/slurp.py
|
|
create mode 100644 test/integration/targets/fetch/run_fetch_tests.yml
|
|
create mode 100755 test/integration/targets/fetch/runme.sh
|
|
|
|
diff --git a/changelogs/fragments/fetch_no_slurp.yml b/changelogs/fragments/fetch_no_slurp.yml
|
|
new file mode 100644
|
|
index 0000000..c742d40
|
|
--- /dev/null
|
|
+++ b/changelogs/fragments/fetch_no_slurp.yml
|
|
@@ -0,0 +1,2 @@
|
|
+bugfixes:
|
|
+ - In fetch action, avoid using slurp return to set up dest, also ensure no dir traversal CVE-2019-3828.
|
|
diff --git a/lib/ansible/plugins/action/fetch.py b/lib/ansible/plugins/action/fetch.py
|
|
index fbaf992..471732c 100644
|
|
--- a/lib/ansible/plugins/action/fetch.py
|
|
+++ b/lib/ansible/plugins/action/fetch.py
|
|
@@ -106,12 +106,6 @@ class ActionModule(ActionBase):
|
|
remote_data = base64.b64decode(slurpres['content'])
|
|
if remote_data is not None:
|
|
remote_checksum = checksum_s(remote_data)
|
|
- # the source path may have been expanded on the
|
|
- # target system, so we compare it here and use the
|
|
- # expanded version if it's different
|
|
- remote_source = slurpres.get('source')
|
|
- if remote_source and remote_source != source:
|
|
- source = remote_source
|
|
|
|
# calculate the destination name
|
|
if os.path.sep not in self._connection._shell.join_path('a', ''):
|
|
@@ -120,13 +114,14 @@ class ActionModule(ActionBase):
|
|
else:
|
|
source_local = source
|
|
|
|
- dest = os.path.expanduser(dest)
|
|
+ # ensure we only use file name, avoid relative paths
|
|
+ if not is_subpath(dest, original_dest):
|
|
+ # TODO: ? dest = os.path.expanduser(dest.replace(('../','')))
|
|
+ raise AnsibleActionFail("Detected directory traversal, expected to be contained in '%s' but got '%s'" % (original_dest, dest))
|
|
+
|
|
if flat:
|
|
if os.path.isdir(to_bytes(dest, errors='surrogate_or_strict')) and not dest.endswith(os.sep):
|
|
- result['msg'] = "dest is an existing directory, use a trailing slash if you want to fetch src into that directory"
|
|
- result['file'] = dest
|
|
- result['failed'] = True
|
|
- return result
|
|
+ raise AnsibleActionFail("dest is an existing directory, use a trailing slash if you want to fetch src into that directory")
|
|
if dest.endswith(os.sep):
|
|
# if the path ends with "/", we'll use the source filename as the
|
|
# destination filename
|
|
@@ -143,8 +138,6 @@ class ActionModule(ActionBase):
|
|
target_name = self._play_context.remote_addr
|
|
dest = "%s/%s/%s" % (self._loader.path_dwim(dest), target_name, source_local)
|
|
|
|
- dest = dest.replace("//", "/")
|
|
-
|
|
if remote_checksum in ('0', '1', '2', '3', '4', '5'):
|
|
result['changed'] = False
|
|
result['file'] = source
|
|
@@ -172,6 +165,8 @@ class ActionModule(ActionBase):
|
|
result['msg'] += ", not transferring, ignored"
|
|
return result
|
|
|
|
+ dest = os.path.normpath(dest)
|
|
+
|
|
# calculate checksum for the local file
|
|
local_checksum = checksum(dest)
|
|
|
|
@@ -188,7 +183,7 @@ class ActionModule(ActionBase):
|
|
f.write(remote_data)
|
|
f.close()
|
|
except (IOError, OSError) as e:
|
|
- raise AnsibleError("Failed to fetch the file: %s" % e)
|
|
+ raise AnsibleActionFail("Failed to fetch the file: %s" % e)
|
|
new_checksum = secure_hash(dest)
|
|
# For backwards compatibility. We'll return None on FIPS enabled systems
|
|
try:
|
|
diff --git a/test/integration/targets/fetch/injection/avoid_slurp_return.yml b/test/integration/targets/fetch/injection/avoid_slurp_return.yml
|
|
new file mode 100644
|
|
index 0000000..af62dcf
|
|
--- /dev/null
|
|
+++ b/test/integration/targets/fetch/injection/avoid_slurp_return.yml
|
|
@@ -0,0 +1,26 @@
|
|
+- name: ensure that 'fake slurp' does not poison fetch source
|
|
+ hosts: localhost
|
|
+ gather_facts: False
|
|
+ tasks:
|
|
+ - name: fetch with relative source path
|
|
+ fetch: src=../injection/here.txt dest={{output_dir}}
|
|
+ become: true
|
|
+ register: islurp
|
|
+
|
|
+ - name: fetch with normal source path
|
|
+ fetch: src=here.txt dest={{output_dir}}
|
|
+ become: true
|
|
+ register: islurp2
|
|
+
|
|
+ - name: ensure all is good in hollywood
|
|
+ assert:
|
|
+ that:
|
|
+ - "'..' not in islurp['dest']"
|
|
+ - "'..' not in islurp2['dest']"
|
|
+ - "'foo' not in islurp['dest']"
|
|
+ - "'foo' not in islurp2['dest']"
|
|
+
|
|
+ - name: try to trip dest anyways
|
|
+ fetch: src=../injection/here.txt dest={{output_dir}}
|
|
+ become: true
|
|
+ register: islurp2
|
|
diff --git a/test/integration/targets/fetch/injection/here.txt b/test/integration/targets/fetch/injection/here.txt
|
|
new file mode 100644
|
|
index 0000000..493021b
|
|
--- /dev/null
|
|
+++ b/test/integration/targets/fetch/injection/here.txt
|
|
@@ -0,0 +1 @@
|
|
+this is a test file
|
|
diff --git a/test/integration/targets/fetch/injection/library/slurp.py b/test/integration/targets/fetch/injection/library/slurp.py
|
|
new file mode 100644
|
|
index 0000000..7b78ba1
|
|
--- /dev/null
|
|
+++ b/test/integration/targets/fetch/injection/library/slurp.py
|
|
@@ -0,0 +1,29 @@
|
|
+#!/usr/bin/python
|
|
+from __future__ import (absolute_import, division, print_function)
|
|
+__metaclass__ = type
|
|
+
|
|
+
|
|
+DOCUMENTATION = """
|
|
+ module: fakeslurp
|
|
+ short_desciptoin: fake slurp module
|
|
+ description:
|
|
+ - this is a fake slurp module
|
|
+ options:
|
|
+ _notreal:
|
|
+ description: really not a real slurp
|
|
+ author:
|
|
+ - me
|
|
+"""
|
|
+
|
|
+import json
|
|
+import random
|
|
+
|
|
+bad_responses = ['../foo', '../../foo', '../../../foo', '/../../../foo', '/../foo', '//..//foo', '..//..//foo']
|
|
+
|
|
+
|
|
+def main():
|
|
+ print(json.dumps(dict(changed=False, content='', encoding='base64', source=random.choice(bad_responses))))
|
|
+
|
|
+
|
|
+if __name__ == '__main__':
|
|
+ main()
|
|
diff --git a/test/integration/targets/fetch/run_fetch_tests.yml b/test/integration/targets/fetch/run_fetch_tests.yml
|
|
new file mode 100644
|
|
index 0000000..f2ff1df
|
|
--- /dev/null
|
|
+++ b/test/integration/targets/fetch/run_fetch_tests.yml
|
|
@@ -0,0 +1,5 @@
|
|
+- name: call fetch_tests role
|
|
+ hosts: testhost
|
|
+ gather_facts: false
|
|
+ roles:
|
|
+ - fetch_tests
|
|
diff --git a/test/integration/targets/fetch/runme.sh b/test/integration/targets/fetch/runme.sh
|
|
new file mode 100755
|
|
index 0000000..7e909dd
|
|
--- /dev/null
|
|
+++ b/test/integration/targets/fetch/runme.sh
|
|
@@ -0,0 +1,12 @@
|
|
+#!/usr/bin/env bash
|
|
+
|
|
+set -eux
|
|
+
|
|
+# setup required roles
|
|
+ln -s ../../setup_remote_tmp_dir roles/setup_remote_tmp_dir
|
|
+
|
|
+# run old type role tests
|
|
+ansible-playbook -i ../../inventory run_fetch_tests.yml -e "output_dir=${OUTPUT_DIR}" -v "$@"
|
|
+
|
|
+# run tests to avoid path injection from slurp when fetch uses become
|
|
+ansible-playbook -i ../../inventory injection/avoid_slurp_return.yml -e "output_dir=${OUTPUT_DIR}" -v "$@"
|
|
--
|
|
2.27.0
|
|
|