CVE-2023-28371 (published 2023-03-15T04:15Z)

In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory traversal.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/Stellarium/stellarium
commit_details: repo_url: https://github.com/Stellarium/stellarium
author: Georg Zotti
author_date: 2023-03-04 18:02:01+01:00
msg: Fix a possible security issue
- disallow overwriting config.ini
repository: repo_url: https://github.com/Stellarium/stellarium
repo_name: Stellarium/stellarium
description: Stellarium is a free GPL software which renders realistic skies in real time with OpenGL. It is available for Linux/Unix, Windows and macOS. With Stellarium, you really see what you can see with your eyes, binoculars or a small telescope.
repo_language: C++
owner: Stellarium
file_changes: filename: StelScriptOutput.cpp
change_type: ModificationType.MODIFY
diff: @@ -62,6 +62,12 @@ void StelScriptOutput::saveOutputAs(const QString &name)
 
 	const bool okToSaveToAbsolutePath=StelApp::getInstance().getSettings()->value("scripts/flag_script_allow_write_absolute_path", false).toBool();
 
+	if (name.contains("config.ini"))
+	{
+		qWarning() << "SCRIPTING ERROR: You are trying to overwrite config.ini. Ignoring.";
+		return;
+	}
+
 	if (!okToSaveToAbsolutePath && ((newFileNameInfo.isAbsolute() || (name.contains(".."))))) // The last condition may include dangerous/malicious paths
 	{
 		qWarning() << "SCRIPTING CONFIGURATION ISSUE: You are trying to save to an absolute pathname or move up in directories.";

programming_language: C++
repo_url: https://github.com/Stellarium/stellarium
commit_details: repo_url: https://github.com/Stellarium/stellarium
author: Georg Zotti
author_date: 2023-03-04 16:15:54+01:00
msg: Fix a possible security issue
- script output might have been stored to paths elsewhere
- Thanks to G.C. for reporting
repository: repo_url: https://github.com/Stellarium/stellarium
repo_name: Stellarium/stellarium
description: Stellarium is a free GPL software which renders realistic skies in real time with OpenGL. It is available for Linux/Unix, Windows and macOS. With Stellarium, you really see what you can see with your eyes, binoculars or a small telescope.
repo_language: C++
owner: Stellarium
file_changes: filename: StelScriptOutput.cpp
change_type: ModificationType.MODIFY
diff: @@ -56,15 +56,15 @@ void StelScriptOutput::reset(void)
 void StelScriptOutput::saveOutputAs(const QString &name)
 {
 	QFile asFile;
-	QFileInfo outputInfo(outputFile);
-	QDir dir=outputInfo.dir(); // will hold complete dirname
-	QFileInfo newFileNameInfo(name);
+	const QFileInfo outputInfo(outputFile);
+	const QDir dir=outputInfo.dir(); // will hold complete dirname
+	const QFileInfo newFileNameInfo(name);
 
-	bool okToSaveToAbsolutePath=StelApp::getInstance().getSettings()->value("scripts/flag_script_allow_write_absolute_path", false).toBool();
+	const bool okToSaveToAbsolutePath=StelApp::getInstance().getSettings()->value("scripts/flag_script_allow_write_absolute_path", false).toBool();
 
-	if (!okToSaveToAbsolutePath && (newFileNameInfo.isAbsolute()))
+	if (!okToSaveToAbsolutePath && ((newFileNameInfo.isAbsolute() || (name.contains(".."))))) // The last condition may include dangerous/malicious paths
 	{
-		qWarning() << "SCRIPTING CONFIGURATION ISSUE: You are trying to save to an absolute pathname.";
+		qWarning() << "SCRIPTING CONFIGURATION ISSUE: You are trying to save to an absolute pathname or move up in directories.";
 		qWarning() << "  To enable this, edit config.ini and set [scripts]/flag_script_allow_write_absolute_path=true";
 		asFile.setFileName(dir.absolutePath() + "/" + newFileNameInfo.fileName());
 		qWarning() << "  Storing to " << asFile.fileName() << " instead";

programming_language: C++
filename: StelScriptOutput.hpp
change_type: ModificationType.MODIFY
diff: @@ -41,12 +41,13 @@ public:
 	static void writeLog(QString msg);
 
 	//! Reset file, i.e., empty it. This may be useful to have repetitive output which may be read by other programs.
+	//! Normally you would call saveOutputAs(...), then reset().
 	static void reset(void);
 
 	//! Save to new file, re-create output file.
 	//! This allows reading of results on Windows, where otherwise reading programs cannot access files opened for writing by Stellarium.
 	//! @param name new filename. If this is not an absolute path, it will be created in the same directory as output.txt
-	//! @note For storing to absolute path names, set [scripts]/flag_script_allow_write_absolute_path=true.
+	//! @note For storing to absolute path names or paths containing directory navigation (".."), set [scripts]/flag_script_allow_write_absolute_path=true.
 	//! Normally you would call saveOutputAs(...), then reset().
 	static void saveOutputAs(const QString& name);
 

programming_language: C++
repo_url: https://github.com/Stellarium/stellarium
commit_details: repo_url: https://github.com/Stellarium/stellarium
author: Georg Zotti
author_date: 2023-03-04 18:03:44+01:00
msg: Fix a possible security issue
- Require manually set flag to run scripts from absolute pathname
- Mostly applies to scripts given on the command line
repository: repo_url: https://github.com/Stellarium/stellarium
repo_name: Stellarium/stellarium
description: Stellarium is a free GPL software which renders realistic skies in real time with OpenGL. It is available for Linux/Unix, Windows and macOS. With Stellarium, you really see what you can see with your eyes, binoculars or a small telescope.
repo_language: C++
owner: Stellarium
file_changes: filename: app_config_ini.tex
change_type: ModificationType.MODIFY
diff: @@ -736,6 +736,8 @@ password   & string & Password for proxy. E.g. \emph{xxxxx}\\\bottomrule
 \begin{tabularx}{\textwidth}{l|l|l|X}\toprule
 \emph{ID}                  & \emph{Type} & \emph{Default} & \emph{Description}\\\midrule
 startup\_script                            & string & startup.ssc & name of script executed on program start\\
+flag\_script\_allow\_absolute\_path        & bool   & false       & set true to allow scripts from absolute pathnames.
+                                                                    This may pose a security risk if you run arbitrary scripts.\\
 flag\_script\_allow\_write\_absolute\_path & bool   & false       & set true to let scripts store files to absolute pathnames.
                                                                     This may pose a security risk if you run scripts from other authors
                                                                     without checking what they are doing.\\\bottomrule 

programming_language: TeX
filename: StelScriptMgr.cpp
change_type: ModificationType.MODIFY
diff: @@ -794,8 +794,10 @@ bool StelScriptMgr::runPreprocessedScript(const QString &preprocessedScript, con
 bool StelScriptMgr::runScript(const QString& fileName, const QString& includePath)
 {
 	QString preprocessedScript;
-	prepareScript(preprocessedScript,fileName,includePath);
-	return runPreprocessedScript(preprocessedScript,fileName);
+	if (prepareScript(preprocessedScript,fileName,includePath))
+		return runPreprocessedScript(preprocessedScript,fileName);
+	else
+		return false;
 }
 
 bool StelScriptMgr::runScriptDirect(const QString scriptId, const QString &scriptCode, int &errLoc, const QString& includePath)
@@ -820,9 +822,20 @@ bool StelScriptMgr::runScriptDirect(const QString& scriptCode, const QString &in
 bool StelScriptMgr::prepareScript( QString &script, const QString &fileName, const QString &includePath)
 {
 	QString absPath;
+	const bool okToRunScriptFromAbsolutePath=StelApp::getInstance().getSettings()->value("scripts/flag_script_allow_absolute_path", false).toBool();
 
 	if (QFileInfo(fileName).isAbsolute())
-		absPath = fileName;
+	{
+		// Absolute paths may bear a security risk. We need a flag to allow them!
+		if (okToRunScriptFromAbsolutePath)
+			absPath = fileName;
+		else
+		{
+			qWarning() << "SCRIPTING CONFIGURATION ISSUE: You are trying to run a script from absolute pathname.";
+			qWarning() << "  To enable this, edit config.ini and set [scripts]/flag_script_allow_absolute_path=true";
+			return false;
+		}
+	}
 	else
 		absPath = StelFileMgr::findFile("scripts/" + fileName);
 

programming_language: C++