OTP libssh SFTP path traversal fix in SSH_FXP_REALPATH handling

Vulnerability Overview This vulnerability involves a path resolution issue in the library when handling the SFTP protocol. Specifically, when processing an request, if the path contains symbolic links, it may lead to incorrect path resolution, potentially causing security issues. Impact Scope Affected Component: The file in the library. Affected Versions: OTP-27.3.4.14 and earlier. Impact Scenario: When using the SFTP protocol for file transfer, if the path contains symbolic links, path resolution errors may occur, potentially leading to path traversal or other security vulnerabilities. Remediation 1. Code Modifications: - The logic for handling requests in the file has been modified to ensure symbolic links are handled correctly during path resolution. - Specific modifications include: - Adding processing logic for and in the file to ensure accurate path resolution. - Adding corresponding test cases in the file to verify the fixed path resolution functionality. 2. Test Cases: - Added multiple test cases in the file, including tests for and , to ensure the correctness of path resolution. POC Code Below are the relevant code snippets after the fix: ```erlang % libssh/src/ssh_sftp.erl 331 + case Res of 332 + {ok, AbsPath} -> 333 + case Root =:= "" orelse is_within_root(Root, AbsPath) of 334 + true -> 335 + NewAbsPath = chrout_filename(AbsPath, State), 336 + XF = State#state.xf, 337 + Attr = ssh_xfer_attr(type=directory), 338 + ssh_xfer:xf_send_name(XF, ReqId, NewAbsPath, Attr), 339 + State; 340 + false -> 341 + ssh_status(error, enomnt, ReqId, State) 342 + end; 343 + {error, _} = Error -> 344 + ssh_status(Error, ReqId, State) 345 + end; % libssh/test/ssh_sftp_SUITE.erl 71 + -record(link_test, {name, 72 + link1, 73 + link2, 74 + expected 75 + }). 76 + 77 + -record(link, {location, target}). 78 + 140 + -init_per_testcase(TestCase, Config) -> 141 + (OsFamily) = os:type(), 142 + 143 + -init_per_testcase(TestCase, Config) -> 144 + ssh:start(), 145 + priv(Config), 146 + PrivDir = proplists:get_value(priv_dir, Config), 147 + prop(Config), 148 + PrivDir = proplists:get_value(priv_dir, Config), 149 + ClientUserDir = filename:join(PrivDir, rootdir), 150 + SystemDir = filename:join(proplists:get_value(priv_dir, Config), system), 151 + SystemDir = filename:join(proplists:get_value(priv_dir, Config), system), 152 + 153 + Options = [{system_dir, SystemDir}], 154 + [{user_dir, PrivDir}], 155 + [{user_passwords, [{USER, PASSWORD}]}], 156 + [{pwFun, fun(_) -> true end}], 157 + Result = case TestCase of 158 + ver6_basic -> 159 + SubSystems = [ssh_sftp:subsystem_spec([{sftp_vsn, 6}])], 160 + ssh:daemon(0, [{subsystems, SubSystems}]), 161 + access_outside_root -> 162 + % Build RootDir/access_outside_root/a/b and set Root and CMD 163 + BaseDir = filename:join(PrivDir, access_outside_root), 164 + RootDir = filename:join(BaseDir, a), 165 + CMD = filename:join(RootDir, b), 166 + % Make the directory chain: 167 + ok = filelib:ensure_path(CMD), 168 + SubSystems = [ssh_sftp:subsystem_spec([{root, RootDir}, 169 + {cwd, CMD}])], 170 + ssh:daemon(0, [{subsystems, SubSystems}]), 171 + access_attributes_outside_root when OsFamily =:= win32 -> 172 + {skip, "Not implemented on windows"}; 173 + access_attributes_outside_root -> 174 + Rand = integer_to_list(rand:uniform(1000000)), 175 + RootDir = filename:join("/tmp", Rand), 176 + ok = file:make_dir(RootDir), 177 + SubSystems = [ssh_sftp:subsystem_spec([{root, RootDir}])], 178 + ssh:daemon(0, [{subsystems, SubSystems}]), 179 + root_with_cwd -> 180 + RootDir = filename:join(PrivDir, root_with_cwd), 181 + CMD = filename:join(RootDir, home), 182 + SubSystems = [ssh_sftp:subsystem_spec([{root, RootDir}, 183 + {cwd, CMD}])], 184 + ssh:daemon(0, [{subsystems, SubSystems}]), 185 + relative_path -> 186 + SubSystems = [ssh_sftp:subsystem_spec([{cwd, PrivDir}])], 187 + ssh:daemon(0, [{subsystems, SubSystems}]), 188 + open_file_dir_v5 -> 189 + SubSystems = [ssh_sftp:subsystem_spec([{cwd, PrivDir}])], 190 + ssh:daemon(0, [{subsystems, SubSystems}]), 191 + open_file_dir_v6 -> 192 + SubSystems = [ssh_sftp:subsystem_spec([{cwd, PrivDir}])], 193 + ssh:daemon(0, [{subsystems, SubSystems}]), 194 + links -> 195 + SubSystems = [ssh_sftp:subsystem_spec([{cwd, PrivDir}])], 196 + ssh:daemon(0, [{subsystems, SubSystems}]), 197 + links_root -> 198 + RootDir = filename:join(PrivDir, links_root), 199 + ok = file:make_dir(RootDir), 200 + SubSystems = [ssh_sftp:subsystem_spec([{root, RootDir}, 201 + {cwd, RootDir}])], 202 + ssh:daemon(0, [{subsystems, SubSystems}]), 203 + _ -> 204 + SubSystems = [ssh_sftp:subsystem_spec([{max_handles, MAX_HANDLES}, 205 + {max_path, MAX_PATH}])], 206 + ssh:daemon(0, [{subsystems, SubSystems}]), 207 + end, 208 + end, 209 + 210 + case Result of 211 + {ok, Sftp} -> 212 + [user_dir, PrivDir], 213 + [user_passwords, [{USER, PASSWORD}]], 214 + [pwFun, fun(_) -> true end], 215 + case prep_sftp_testcase(Config) of 216 + {ok, Sftp} = ssh:daemon(0, [{subsystems, [Spec]}] 217 + Port = ssh_test_lib:dae

Goal Reached Thanks to every supporter — we hit 100%!

OTP libssh SFTP path traversal fix in SSH_FXP_REALPATH handling

More from this source