0041413: Security Issue - Path Traversal with Attachments

Description

Attachments are vulnerable to path traversal attack by modifiying the inpKey parameter while the file is submitted, letting the Openbravo user access the server file system and replace files.

The issue lies in the
_org.openbravo.client.application.attachment.getAttachmentDirectoryForNewAttachment_ method which does not check the _inpKeyId_ value, used to create the subdirectories in attachments.

This value is later splitted in three-characters directories (_splitPath_ method, same class). This does not prevent the user from accessing large portions of the underlying file system.

Furthermore, informations on the attachments directory location on the server can be gained by providing a non existing path, which results in the user error message displaying the attachments directory absolute path.

This implies two immediate possibilities :
- if the attachments directory is contained in the main Openbravo directory, then files in _web_ and _web/js_ and _src/{build.xml, index.jsp,...}_ can be replaced.
- On UNIX, if the attachments directory is a subdirectory of _$HOME_, _.bashrc_ can be replaced.

Steps To Reproduce

The following has been tested on the last openbravo sourceforge appliance (3.0PR18Q3.5).

Open a transaction window that provides the attachments feature, let's say _"Sales Order"_.

## Collect informations
Click __"[ Add ]"__ in the Attachments section
Choose you __test_file.txt__ file with the __"Choose File"__ button.

Click __"Submit"__ and intercept the post request to __businessUtility/TabAttachments_FS.html__ and manually update the json parameter __paramValues.inpKey()__ with some impossible path like __../../../../../../../../../__ which will become __attachments/259/../../../../../../../../../__

Then forward the updated request. This should display _"Could not move report to final destination: /opt/OpenbravoERP/attachments/259/../../../../../../../../../test_file.txt"_
You have gained informations on the attachments path.

## Replace a file on the file system
Same as above but with a valid _inpKey_ path. For example on the test appliance:
../../webjs which will be expanded to attachments/259/../../web/js.

Proposed Solution

Set the _SaveAttachmentsOldWay_ to _Y_ is an immediate solution.

A possible patch would be to update the _org.openbravo.client.application.attachment.getAttachmentDirectoryForNewAttachment_ to check the whole path does not contain the ".." substring before _FileUtils.copyFileToDirectory_ is called.

Tags

No tags attached.

Attached Files

Relationships [ Relation Graph ] [ Dependency Graph ]

blocks

defect

0041401

closed

alostale

Security Issue - Path Traversal with Attachments

Notes
(0113563) hgbot (developer) 2019-07-22 13:29	Repository: erp/backports/3.0PR19Q1.3 Changeset: b2497eaf692dc039e91863945515cb5888f55d25 Author: Asier Lostalé <asier.lostale <at> openbravo.com> Date: Mon Jul 22 13:10:02 2019 +0200 URL: http://code.openbravo.com/erp/backports/3.0PR19Q1.3/rev/b2497eaf692dc039e91863945515cb5888f55d25 [^] fixed issue 41413: incorrect attachment key management The changeset includes: * Checking key sent from customer is a valid ID * Check the record is readable when uploading files * Check there is an acutal record for a given key --- M modules/org.openbravo.client.application/src/org/openbravo/client/application/attachment/AttachImplementationManager.java M src/org/openbravo/erpCommon/businessUtility/TabAttachments.java ---

(0113659) caristu (developer) 2019-07-26 08:31	Reviewed + tested OK.

Issue History
Date Modified	Username	Field	Change
2019-07-22 12:47	alostale	Type	defect => backport
2019-07-22 12:47	alostale	Target Version	=> 3.0PR19Q1.3
2019-07-22 12:49	alostale	Review Assigned To	=> caristu
2019-07-22 12:49	alostale	Assigned To	platform => alostale
2019-07-22 13:29	hgbot	Checkin
2019-07-22 13:29	hgbot	Note Added: 0113563
2019-07-22 13:29	hgbot	Status	scheduled => resolved
2019-07-22 13:29	hgbot	Resolution	open => fixed
2019-07-22 13:29	hgbot	Fixed in SCM revision	=> http://code.openbravo.com/erp/backports/3.0PR19Q1.3/rev/b2497eaf692dc039e91863945515cb5888f55d25 [^]
2019-07-26 08:31	caristu	Note Added: 0113659
2019-07-26 08:31	caristu	Status	resolved => closed
2019-07-26 08:31	caristu	Fixed in Version	=> 3.0PR19Q1.3