block uw mailbox abuse in imap select command instead of applying same

code in all scripts that get $mailbox from GET or POST.

don't check imap_server_type, because interface can be used with different
type setting.

display error message instead of silently overriding $mailbox. (#1557078)

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@11781 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/ChangeLog b/ChangeLog
index 5b87af5755af92ee594dcefab4cfc04bc7d1a66e..08e01578df9753fdef4e7430f14371e4c8014335 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -135,7 +135,9 @@ Version 1.5.2 - CVS
   - Added APOP, TLS and STLS support to mail_fetch plugin (#575299).
   - Added Courier IMAP OUTBOX check to configtest utility.
   - Moved login_form hook to its own table row on login page.
-  - Added check_plugin_version() function
+  - Added check_plugin_version() function.
+  - If mailbox name starts with slash or contains ../, error message is
+    generated. Safety check for insecure default UW IMAP setup (#1557078).
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------

diff --git a/functions/imap_mailbox.php b/functions/imap_mailbox.php
index 40ceac2d787b9fe2360dead84bbb06362057ac3e..b6a36c0fe6eb07cdae63ed9a6e341173d800b087 100755 (executable)
--- a/functions/imap_mailbox.php
+++ b/functions/imap_mailbox.php
@@ -364,8 +364,27 @@ function sqimap_mailbox_select ($imap_stream, $mailbox) {
     if ($mailbox == 'None') {
         return;
     }
+
     // cleanup $mailbox in order to prevent IMAP injection attacks
     $mailbox = str_replace(array("\r","\n"), array("",""),$mailbox);
+
+    /**
+     * Default UW IMAP server configuration allows to access other files
+     * on server. $imap_server_type is not checked because interface can
+     * be used with 'other' or any other server type setting. $mailbox
+     * variable can be modified in any script that uses variable from GET
+     * or POST. This code blocks all standard SquirrelMail IMAP API requests
+     * that use mailbox with full path (/etc/passwd) or with ../ characters
+     * in path (../../etc/passwd)
+     */
+    if (strstr($mailbox, '../') || substr($mailbox, 0, 1) == '/') {
+        global $oTemplate;
+        error_box(sprintf(_("Invalid mailbox name: %s"),htmlspecialchars($mailbox)));
+        sqimap_logout($imap_stream);
+        $oTemplate->display('footer.tpl');
+        die();
+    }
+
     $read = sqimap_run_command($imap_stream, 'SELECT ' . sqimap_encode_mailbox_name($mailbox),
                                true, $response, $message);
     $result = array();

diff --git a/src/right_main.php b/src/right_main.php
index e644d8d150465b57a98756bdac92a7d410f61b89..0e33723ec033de420f0c4e9eeb7b0ebd4e17b780 100644 (file)
--- a/src/right_main.php
+++ b/src/right_main.php
@@ -77,11 +77,6 @@ $imapConnection = sqimap_login($username, false, $imapServerAddress, $imapPort,
 
 $mailbox = (isset($mailbox) && $mailbox) ? $mailbox : 'INBOX';
 
-/* compensate for the UW vulnerability. */
-if ($imap_server_type == 'uw' && (strstr($mailbox, '../') ||
-                                  substr($mailbox, 0, 1) == '/')) {
-   $mailbox = 'INBOX';
-}
 /**
  * Set the global settings for a mailbox and merge them with the usersettings
  * for the mailbox. In the future we can add more mailbox specific preferences