Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

fix(security): fix RCE on mib import from manufacturer input #8023

Merged
merged 4 commits into from
Oct 30, 2019
Merged

fix(security): fix RCE on mib import from manufacturer input #8023

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
52df8d8
fix(security): fix RCE on mib import from manufacturer input
kduret Oct 22, 2019
ffbfc23
Update www/include/configuration/configObject/traps-mibs/formMibs.php
kduret Oct 23, 2019
f8ac5d9
Update www/include/configuration/configObject/traps-mibs/formMibs.php
kduret Oct 23, 2019
d2acdfd
manage errors in trap generation
kduret Oct 28, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 9 additions & 19 deletions www/include/configuration/configObject/traps-mibs/formMibs.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,15 +70,6 @@ function myDecodeMib($arg)
'linkedObject' => 'centreonManufacturer'
);

/**
* commented out as deprecated, but kept for reference
$route = './include/common/webServices/rest/internal.php?object=centreon_configuration_manufacturer' .
'&action=defaultValues&target=traps&field=manufacturer_id&id=';
$attrManufacturer1 = array_merge(
$attrManufacturer,
array('defaultDatasetRoute' => $route)
);
*/
$form->addElement('select2', 'mnftr', _("Vendor Name"), array(), $attrManufacturer);

$form->addElement('file', 'filename', _("File (.mib)"));
Expand Down Expand Up @@ -117,31 +108,31 @@ function myDecodeMib($arg)
*/
$subA = $form->addElement('submit', 'submit', _("Import"), array("class" => "btc bt_success"));
$form->addElement('header', 'status', _("Status"));
$valid = false;
$msg = null;
$stdout = null;
if ($form->validate()) {
$ret = $form->getSubmitValues();

$fileObj = $form->getElement('filename');
$manufacturerId = filter_var($ret['mnftr'], FILTER_VALIDATE_INT);

if ($fileObj->isUploadedFile()) {
if ($manufacturerId === false) {
$tpl->assign('msg', 'Wrong manufacturer given.');
} elseif ($fileObj->isUploadedFile()) {
/*
* Upload File
*/
$values = $fileObj->getValue();
$msg .= str_replace("\n", "<br />", $stdout);
$msg .= "<br />Moving traps in DataBase...";

$command = "@CENTREONTRAPD_BINDIR@/centFillTrapDB -f '" . $values["tmp_name"]
. "' -m " . $manufacturerId . " --severity=info 2>&1";

if ($debug) {
print("@CENTREONTRAPD_BINDIR@/centFillTrapDB -f '" . $values["tmp_name"] . "' -m " .
htmlentities($ret["mnftr"], ENT_QUOTES, "UTF-8") . " --severity=info 2>&1");
print($command);
}

$stdout = shell_exec(
"@CENTREONTRAPD_BINDIR@/centFillTrapDB -f '" . $values["tmp_name"] .
"' -m " . htmlentities($ret["mnftr"], ENT_QUOTES, "UTF-8") . " --severity=info 2>&1"
);
$stdout = shell_exec($command);
unlink($values['tmp_name']);
$msg .= "<br />" . str_replace("\n", "<br />", $stdout);
$msg .= "<br />Generate Traps configuration files from Monitoring Engine configuration form!";
Expand All @@ -153,7 +144,6 @@ function myDecodeMib($arg)
$tpl->assign('msg', $msg);
}
}
$valid = true;
}

/*
Expand Down