Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix services command injection #13932

Merged
merged 4 commits into from Apr 21, 2022
Merged

Conversation

murrant
Copy link
Member

@murrant murrant commented Apr 19, 2022

Reported by
● Darek Jensen
● haxmeadroom

Please note

Please read this information carefully. You can run ./lnms dev:check to check your code before submitting.

  • Have you followed our code guidelines?
  • If my Pull Request does some changes/fixes/enhancements in the WebUI, I have inserted a screenshot of it.
  • If my Pull Request makes discovery/polling/yaml changes, I have added/updated test data.

Testers

If you would like to test this pull request then please run: ./scripts/github-apply <pr_id>, i.e ./scripts/github-apply 5926
After you are done testing, you can remove the changes with ./scripts/github-remove. If there are schema changes, you can ask on discord how to revert.

Copy link

@haxmeadroom haxmeadroom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would probably also help to sanitize service_ip, hostname, and service_param

@Jellyfrog
Copy link
Member

Jellyfrog commented Apr 19, 2022

github doesnt allow you to comment on lines too far outside a diff, but on line 135 this is wrong also, should be an array with arguments and pipe it thought escapeshellarg()

@murrant
Copy link
Member Author

murrant commented Apr 19, 2022

@Jellyfrog absolutely... unfortunately, service_params is just a string stored in the database free-form entered by the admin. My thoughts is change it to accept both that and array based parameters (when running, not saving). But that also requires a ui change.

@murrant murrant merged commit 8b82341 into librenms:master Apr 21, 2022
10 checks passed
@murrant murrant deleted the fix-services-injection branch April 21, 2022 02:32
@librenms-bot
Copy link

This pull request has been mentioned on LibreNMS Community. There might be relevant details there:

https://community.librenms.org/t/22-4-0-changelog/18610/1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants