Using this script leads to path traversal vulnerability

[yahesh]

We installed your script in a test environment and where presented with URLs in the form

https://<ip>:9980/loleaflet/<id>/loleaflet.html?file_path=file:///opt/online/test/data/hello-world.odt

We were curious and tried other paths - with success - like:

https://<ip>:9980/loleaflet/<id>/loleaflet.html?file_path=file:///etc/passwd
https://<ip>:9980/loleaflet/<id>/loleaflet.html?file_path=file:///etc/ssh/sshd_config

The readme document does not point out that using officeonlin-install.sh opens the corresponding server to such a path traversal vulnerability.

[aalaesar]

Hi.
Thank you for reporting this very important issue.
At this point I'm not sure if this vulnerability is implied by the libreoffice online design or
if this this a test feature that should be deactivated either in config or in the build.
This requires more investigations.
Like testing this vulnerability from an external network. And maybe a comparative test with the official collabora docker image.

[Kassiematis]

This should be removed from the script on line 588.

--o:storage.filesystem[@allow]=true

only this test will not work anymore.

https://:9980/loleaflet//loleaflet.html?file_path=file:///opt/online/test/data/hello-world.odt

[aalaesar]

@Kassiematis
it's config then, nice !
👍

[yahesh]

Seems to work for us. :)

[Kassiematis]

Should we change the script? Testing availability can still be done with this link.
https://admin:password@localhost:9980/loleaflet/dist/admin/admin.html

In /opt/online/loolwsd.xml it can still be activated by changing

<storage desc="Backend storage"> <filesystem allow="false" />

to true

For debug/testing purposes only.

[aalaesar]

definitively yes but we must find how to remove the prompt showing the test URI or many won't understand why the test instructions are not working.
Https://ip:9980/hosting/discovery is also a good way to test the service availability.

[Kassiematis]

Prompt can be removed by removing --enable-debug at line 316

lool_configure_opts='--enable-debug'

https://admin:password@localhost:9980/loleaflet/dist/admin/admin.html still works

[Kassiematis]

Pull requests created,

#97
#98