net/asterisk-16.x/patches/180-AST-2019-007-16.diff

   1 From 7574be5110e049a44b8c8ead52cd1c2a5d442afa Mon Sep 17 00:00:00 2001
   2 From: George Joseph <gjoseph@digium.com>
   3 Date: Thu, 24 Oct 2019 11:41:23 -0600
   4 Subject: [PATCH] manager.c:  Prevent the Originate action from running the Originate app
   5
   6 If an AMI user without the "system" authorization calls the
   7 Originate AMI command with the Originate application,
   8 the second Originate could run the "System" command.
   9
  10 Action: Originate
  11 Channel: Local/1111
  12 Application: Originate
  13 Data: Local/2222,app,System,touch /tmp/owned
  14
  15 If the "system" authorization isn't set, we now block the
  16 Originate app as well as the System, Exec, etc. apps.
  17
  18 ASTERISK-28580
  19 Reported by: Eliel Sardañons
  20
  21 Change-Id: Ic4c9dedc34c426f03c8c14fce334a71386d8a5fa
  22 ---
  23
  24 diff --git a/doc/UPGRADE-staging/AMI-Originate.txt b/doc/UPGRADE-staging/AMI-Originate.txt
  25 new file mode 100644
  26 index 0000000..f2d3133
  27 --- /dev/null
  28 +++ b/doc/UPGRADE-staging/AMI-Originate.txt
  29 @@ -0,0 +1,5 @@
  30 +Subject: AMI
  31 +
  32 +The AMI Originate action, which optionally takes a dialplan application as
  33 +an argument, no longer accepts "Originate" as the application due to
  34 +security concerns.
  35 diff --git a/main/manager.c b/main/manager.c
  36 index f138801..1963151 100644
  37 --- a/main/manager.c
  38 +++ b/main/manager.c
  39 @@ -5744,6 +5744,7 @@
  40                                                                      EAGI(/bin/rm,-rf /)       */
  41                                 strcasestr(app, "mixmonitor") ||  /* MixMonitor(blah,,rm -rf)  */
  42                                 strcasestr(app, "externalivr") || /* ExternalIVR(rm -rf)       */
  43 +                               strcasestr(app, "originate") ||   /* Originate(Local/1234,app,System,rm -rf) */
  44                                 (strstr(appdata, "SHELL") && (bad_appdata = 1)) ||       /* NoOp(${SHELL(rm -rf /)})  */
  45                                 (strstr(appdata, "EVAL") && (bad_appdata = 1))           /* NoOp(${EVAL(${some_var_containing_SHELL})}) */
  46                                 )) {