Flaw in CGI mapfile loading makes it possible to bypass security controls. #6313

sdlime · 2021-04-30T18:59:19Z

MapServer developers have identified a critical flaw in the logic associated with processing map parameter. It is possible to specify an arbitrary mapfile that bypasses the MS_MAP_NO_PATH and MS_MAP_PATTERN checks. This issue makes it difficult to easily limit where MapServer can load a mapfile from and applies to versions 4.10 and newer.

--Steve

CVE ID: CVE-2021-32062

…security controls (#6313) (#6314) * Create coverity-scan.yml * Update coverity-scan.yml * Avoid resource leak... (CID 1503409) * Revert "Avoid resource leak... (CID 1503409)" This reverts commit 7d261af. * Updated... * Limit action to MapServer/MapServer repo, run every Sunday (for now). * Always force map parameter values through validation checks. Add validation checks on environment variable names. * msIsValidRegex(): fix memleak Co-authored-by: Even Rouault <even.rouault@spatialys.com>

…security controls (MapServer#6313) (MapServer#6314) * Create coverity-scan.yml * Update coverity-scan.yml * Avoid resource leak... (CID 1503409) * Revert "Avoid resource leak... (CID 1503409)" This reverts commit 7d261af. * Updated... * Limit action to MapServer/MapServer repo, run every Sunday (for now). * Always force map parameter values through validation checks. Add validation checks on environment variable names. * msIsValidRegex(): fix memleak Co-authored-by: Even Rouault <even.rouault@spatialys.com>

…security controls (#6313) (#6314) * Create coverity-scan.yml * Update coverity-scan.yml * Avoid resource leak... (CID 1503409) * Revert "Avoid resource leak... (CID 1503409)" This reverts commit 7d261af. * Updated... * Limit action to MapServer/MapServer repo, run every Sunday (for now). * Always force map parameter values through validation checks. Add validation checks on environment variable names. * msIsValidRegex(): fix memleak Co-authored-by: Even Rouault <even.rouault@spatialys.com>

…security controls (#6313) (#6314) (#6315) Co-authored-by: Even Rouault <even.rouault@spatialys.com> Co-authored-by: Steve Lime <steve.lime@state.mn.us>

sdlime added the Security label Apr 30, 2021

sdlime mentioned this issue Apr 30, 2021

Address flaw in CGI mapfile loading that makes it possible to bypass security controls (#6313) #6314

Merged

sdlime closed this as completed Apr 30, 2021

jmckenna mentioned this issue Apr 30, 2021

update for security releases 7.6.3, 7.4.5, 7.2.3, 7.0.8 MapServer/MapServer-documentation#519

Merged

Flaw in CGI mapfile loading makes it possible to bypass security controls. #6313

Flaw in CGI mapfile loading makes it possible to bypass security controls. #6313

Comments

sdlime commented Apr 30, 2021 • edited

sdlime commented Apr 30, 2021 •

edited