mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-27 19:11:16 +00:00
rpc: avoid ssh interpreting malicious hostname as arguments
Inspired by the recent GIT / Mercurial security flaws (http://blog.recurity-labs.com/2017-08-10/scm-vulns), consider someone/something manages to feed libvirt a bogus URI such as: virsh -c qemu+ssh://-oProxyCommand=gnome-calculator/system In this case, the hosname "-oProxyCommand=gnome-calculator" will get interpreted as an argument to ssh, not a hostname. Fortunately, due to the set of args we have following the hostname, SSH will then interpret our bit of shell script that runs 'nc' on the remote host as a cipher name, which is clearly invalid. This makes ssh exit during argv parsing and so it never tries to run gnome-calculator. We are lucky this time, but lets be more paranoid, by using '--' to explicitly tell SSH when it has finished seeing command line options. This forces it to interpret "-oProxyCommand=gnome-calculator" as a hostname, and thus see a fail from hostname lookup. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
parent
ed8661a309
commit
e4cb850081
@ -868,7 +868,7 @@ int virNetSocketNewConnectSSH(const char *nodename,
|
||||
if (!netcat)
|
||||
netcat = "nc";
|
||||
|
||||
virCommandAddArgList(cmd, nodename, "sh", "-c", NULL);
|
||||
virCommandAddArgList(cmd, "--", nodename, "sh", "-c", NULL);
|
||||
|
||||
virBufferEscapeShell(&buf, netcat);
|
||||
if (virBufferCheckError(&buf) < 0) {
|
||||
|
Loading…
Reference in New Issue
Block a user