libs/web: Added several sanity checks to avoid local privilege escalation

diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua
index 3805f5c9d3323a9988cf834c7b86b11bee5ecd5e..e3dc6370ebbbf12c60c2ebd400909adb5f4daab2 100644 (file)
--- a/libs/web/luasrc/dispatcher.lua
+++ b/libs/web/luasrc/dispatcher.lua
@@ -263,6 +263,13 @@ function createindex_plain(path, suffix)
        if indexcache then
                local cachedate = fs.mtime(indexcache)
                if cachedate and cachedate > fs.mtime(path) then
+
+                       assert(
+                               sys.process.info("uid") == fs.stat(indexcache, "uid")
+                               and fs.stat(indexcache, "mode") == "rw-------",
+                               "Fatal: Indexcache is not sane!"
+                       )
+
                        index = loadfile(indexcache)()
                        return index
                end             
@@ -287,6 +294,7 @@ function createindex_plain(path, suffix)
        
        if indexcache then
                fs.writefile(indexcache, util.get_bytecode(index))
+               fs.chmod(indexcache, "a-rwx,u+rw")
        end
 end
 

diff --git a/libs/web/luasrc/sauth.lua b/libs/web/luasrc/sauth.lua
index 7c483119cae14e9884349e5ba1c6b02e3945067c..0ac236753eaff905e6cee7d303cb6b327d3de6ea 100644 (file)
--- a/libs/web/luasrc/sauth.lua
+++ b/libs/web/luasrc/sauth.lua
@@ -57,7 +57,7 @@ end
 -- @param id   Session identifier
 -- @return             Session data
 function read(id)
-       if not id or not sane() then
+       if not id or not sane(sessionpath .. "/" .. id) then
                return
        end
        clean()
@@ -67,9 +67,11 @@ end
 
 --- Check whether Session environment is sane.
 -- @return Boolean status
-function sane()
-       return luci.sys.process.info("uid") == luci.fs.stat(sessionpath, "uid")
-        and luci.fs.stat(sessionpath, "mode") == "rwx------"
+function sane(file)
+       return luci.sys.process.info("uid")
+                       == luci.fs.stat(file or sessionpath, "uid")
+               and luci.fs.stat(file or sessionpath, "mode")
+                       == (file and "rw-------" or "rwx------")
 end