From cb2cdea8ceff561dc10f41c17df00f74a8a9419e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81ngel=20Gonz=C3=A1lez?= Date: Tue, 25 Nov 2014 23:49:25 +0100 Subject: [PATCH] Properly sanitize mv parameters (CVE-2014-8990) When using -rsyncssh option, some filenames could -in addition of not syncing correctly- crash the service and execute arbitrary commands under the credentials of the remote user. These issues have been assigned CVE-2014-8990 This commit fixes the incomplete and lua5.2-incompatible sanitization performed by 18f02ad0 --- default-rsyncssh.lua | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/default-rsyncssh.lua b/default-rsyncssh.lua index 589837d..3f3261d 100644 --- a/default-rsyncssh.lua +++ b/default-rsyncssh.lua @@ -77,8 +77,10 @@ rsyncssh.action = function( inlet ) -- makes move local on target host -- if the move fails, it deletes the source if event.etype == 'Move' then - local path1 = event.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$') - local path2 = event2.path:gsub ('"', '\\"'):gsub ('`', '\\`'):gsub ('%$','\\%$') + local path1 = config.targetdir .. event.path + local path2 = config.targetdir .. event2.path + path1 = "'" .. path1:gsub ('\'', '\'"\'"\'') .. "'" + path2 = "'" .. path2:gsub ('\'', '\'"\'"\'') .. "'" log( 'Normal', @@ -94,10 +96,10 @@ rsyncssh.action = function( inlet ) config.ssh._computed, config.host, 'mv', - '\"' .. config.targetdir .. path1 .. '\"', - '\"' .. config.targetdir .. path2 .. '\"', + path1, + path2, '||', 'rm', '-rf', - '\"' .. config.targetdir .. path1 .. '\"' + path1 ) return -- 2.1.3