Marek Miklewicz
b4fbd46cc1
extract_payload_from_archive() relied entirely on tar's own default path-traversal protection when extracting a DirectAdmin restore archive to locate the plugin's backup/alt_mysql payload. Explicitly inspect the archive listing first and refuse to extract at all if any member has an absolute path or a ".." segment, rather than trusting that the wildcard extraction pattern happens to filter out an unsafe member.
71 lines
3.0 KiB
Bash
Executable File
71 lines
3.0 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
PLUGIN_DIR="$(cd "$(dirname "$0")/.." && pwd)"
|
|
REAL_SCRIPT="$PLUGIN_DIR/scripts/da-integration/alt_mysql_user_restore_post_pre_cleanup.sh"
|
|
TMP_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_DIR" "/tmp/alt-mysql-traversal-proof"' EXIT
|
|
|
|
fail() {
|
|
echo "FAIL: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
# Extract the exact, real find_payload_in_dir()/extract_payload_from_archive()
|
|
# function bodies from the real script (rather than reimplementing them), so
|
|
# this test exercises the actual production logic without triggering the
|
|
# script's own main() (which needs a full DA restore environment).
|
|
FUNCS_FILE="$TMP_DIR/funcs.sh"
|
|
{
|
|
echo '#!/bin/bash'
|
|
echo 'log() { :; }'
|
|
awk '/^find_payload_in_dir\(\)/,/^\}/' "$REAL_SCRIPT"
|
|
awk '/^extract_payload_from_archive\(\)/,/^\}/' "$REAL_SCRIPT"
|
|
} > "$FUNCS_FILE"
|
|
|
|
grep -q '^find_payload_in_dir()' "$FUNCS_FILE" || fail "could not extract find_payload_in_dir() from $REAL_SCRIPT"
|
|
grep -q '^extract_payload_from_archive()' "$FUNCS_FILE" || fail "could not extract extract_payload_from_archive() from $REAL_SCRIPT"
|
|
|
|
# shellcheck source=/dev/null
|
|
source "$FUNCS_FILE"
|
|
|
|
# --- A legitimate archive must still extract normally ---
|
|
GOOD_STAGE="$TMP_DIR/good_stage"
|
|
mkdir -p "$GOOD_STAGE/backup/alt_mysql/databases"
|
|
printf 'x' > "$GOOD_STAGE/backup/alt_mysql/manifest.json"
|
|
printf 'x' > "$GOOD_STAGE/backup/alt_mysql/databases/demo_db.sql.gz"
|
|
GOOD_ARCHIVE="$TMP_DIR/good.tar"
|
|
( cd "$GOOD_STAGE" && tar -cf "$GOOD_ARCHIVE" backup/alt_mysql/manifest.json backup/alt_mysql/databases/demo_db.sql.gz )
|
|
|
|
GOOD_PAYLOAD="$(extract_payload_from_archive "$GOOD_ARCHIVE")" \
|
|
|| fail "a legitimate archive with a valid manifest must be extracted"
|
|
[ -r "$GOOD_PAYLOAD/manifest.json" ] || fail "extracted payload must contain manifest.json"
|
|
|
|
# --- An archive containing a path-traversal member must be refused entirely ---
|
|
EVIL_STAGE="$TMP_DIR/evil_stage"
|
|
mkdir -p "$EVIL_STAGE/backup/alt_mysql" "$EVIL_STAGE/evil_payload"
|
|
printf 'x' > "$EVIL_STAGE/backup/alt_mysql/manifest.json"
|
|
printf 'malicious content' > "$EVIL_STAGE/evil_payload/evil.sh"
|
|
EVIL_ARCHIVE="$TMP_DIR/evil.tar"
|
|
|
|
(
|
|
cd "$EVIL_STAGE" && {
|
|
tar -cf "$EVIL_ARCHIVE" -s ',^evil_payload/,../../../../../../tmp/alt-mysql-traversal-proof/,' \
|
|
backup/alt_mysql/manifest.json evil_payload/evil.sh 2>/dev/null \
|
|
|| tar -cf "$EVIL_ARCHIVE" --transform 's,^evil_payload/,../../../../../../tmp/alt-mysql-traversal-proof/,' \
|
|
backup/alt_mysql/manifest.json evil_payload/evil.sh
|
|
}
|
|
)
|
|
|
|
tar -tf "$EVIL_ARCHIVE" | grep -Fq '../../../../../../tmp/alt-mysql-traversal-proof/evil.sh' \
|
|
|| fail "test setup broken: the crafted archive does not actually contain a traversal member"
|
|
|
|
EVIL_OUTPUT=""
|
|
if EVIL_OUTPUT="$(extract_payload_from_archive "$EVIL_ARCHIVE" 2>&1)"; then
|
|
fail "an archive containing a path-traversal member must be refused, got payload: $EVIL_OUTPUT"
|
|
fi
|
|
[ ! -e "/tmp/alt-mysql-traversal-proof/evil.sh" ] \
|
|
|| fail "SECURITY: path-traversal member was actually extracted outside the temp dir"
|
|
|
|
echo "da_restore_archive_traversal_test: OK"
|