CVE-2015-8771: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: The generate_smb_nt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2017-02-13T18:59Z
Repository: https://github.com/gosa-project/gosa-core
Language: Other
Files changed: include/class_core.inc, include/functions.inc
Commit date: 2015-10-30 10:07:20 +0000
Commit message: (See #1221)
udpate samba hash generation due to a possible code injection

command line parameter will be passed base64 encoded to avoid 
complex escaping sequences that may alter the initial passphrase



git-svn-id: https://oss.gonicus.de/repositories/gosa/trunk@21280 594d385d-05f5-0310-b6e9-bd551577e9d8

Diff: diff --git a/include/class_core.inc b/include/class_core.inc
index 510bc5e3e..d3acf5b8c 100644
--- a/include/class_core.inc
+++ b/include/class_core.inc
@@ -580,11 +580,11 @@ DEBUG_SI      = 256"),
                                 "mandatory"     => FALSE),
 
                         array(
                                 "name"          => "sambaHashHook",
                                 "type"          => "command",
-                                "default"       => "perl -MCrypt::SmbHash -e \"print join(q[:], ntlmgen %password), $/;\"",
+                                "default"       => "perl -MCrypt::SmbHash -e \"use MIME::Base64; print join(q[:], ntlmgen decode_base64('%password')), $/;\"",
                                 "description"   => _("Command to create Samba NT/LM hashes. Required for password synchronization if you don't use supplementary services."),
                                 "check"         => "gosaProperty::isCommand",
                                 "migrate"       => "",
                                 "group"         => "samba",
                                 "mandatory"     => FALSE),
diff --git a/include/functions.inc b/include/functions.inc
index 7f8404367..0385edf57 100644
--- a/include/functions.inc
+++ b/include/functions.inc
@@ -3099,12 +3099,12 @@ function generate_smb_nt_hash($password)
   } else {
       $password = addcslashes($password, '$'); // <- Escape $ twice for transport from PHP to console-process.
       $password = addcslashes($password, '$'); 
       $password = addcslashes($password, '$'); // <- And again once, to be able to use it as parameter for the perl script.
 	  $tmp = $config->get_cfg_value("core",'sambaHashHook');
-      $tmp = preg_replace("/%userPassword/", escapeshellarg($password), $tmp);
-      $tmp = preg_replace("/%password/", escapeshellarg($password), $tmp);
+      $tmp = preg_replace("/%userPassword/", base64_encode($password), $tmp);
+      $tmp = preg_replace("/%password/", base64_encode($password), $tmp);
 	  @DEBUG (DEBUG_LDAP, __LINE__, __FUNCTION__, __FILE__, $tmp, "Execute");
 
  	  exec($tmp, $ar);
 	  flush();
 	  reset($ar);

Vulnerable code:                                 "default"       => "perl -MCrypt::SmbHash -e \"print join(q[:], ntlmgen %password), $/;\"",
      $tmp = preg_replace("/%userPassword/", escapeshellarg($password), $tmp);
      $tmp = preg_replace("/%password/", escapeshellarg($password), $tmp);
Fixed code:                                 "default"       => "perl -MCrypt::SmbHash -e \"use MIME::Base64; print join(q[:], ntlmgen decode_base64('%password')), $/;\"",
      $tmp = preg_replace("/%userPassword/", base64_encode($password), $tmp);
      $tmp = preg_replace("/%password/", base64_encode($password), $tmp);