Summary

LAM does not properly sanitize configuration values, that are set via mainmanage.php and confmain.php. This allows setting arbitrary config values and thus effectively bypassing mitigation of CVE-2024-23333 (GHSA-fm9w-7m7v-wxqv). Further impact is written below.

Details

Configuration values for the main config or server profiles are set via mainmanage.php and confmain.php.
The values are written to config.cfg or serverprofile.conf in the format of settingsName: settingsValue line-by-line.
An attacker can smuggle arbitrary config values in a config file, by inserting a newline into certain config fields, followed by the value.
Take this excerpt as an example for setting the sessionTimeout value in confmain.php

-----------------------------202826601038830835762869144314
Content-Disposition: form-data; name="sessionTimeout"

30
logDestination: /var/www/html/demo.php
-----------------------------202826601038830835762869144314 

The resulting config file contains now two entries for logDestination

[..]
default: lam
logLevel: 4
logDestination: SYSLOG
[..]
license:
sessionTimeout: 30
logDestination: /var/www/html/demo.php
[..]

Due to the line-by-line parsing from reading the config, the logDestination value will be set to the smuggled value, effectively bypassing the valid filename setting for logDestination.

PoC

See above

Impact

1. The vulnerability allows setting arbitrary values for fields, regardless of sanitization checks.
2. Bypassing mitigation of CVE-2024-23333 (GHSA-fm9w-7m7v-wxqv).
3. Disrupt availability by setting invalid settings , e.g. password: {SSHA}A B making it impossible to login.
4. Further, for server profiles the values are retrieved through reflection. This allows attacker controlled direct access to any property of the LamConfig object and could lead to further potential security impact.