CVE-2018-14355 (published 2018-07-17T17:29Z)

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://gitlab.com/muttmua/mutt
commit_details: repo_url: https://gitlab.com/muttmua/mutt
author: Richard Russon
author_date: 2018-07-13 11:33:16-07:00
msg: Selectively cache headers.

Thanks to NeoMutt and Jeriko One for the patch, which was slightly
modified to apply to the Mutt code.
repository: repo_url: https://gitlab.com/muttmua/mutt
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: muttmua
file_changes: filename: util.c
change_type: ModificationType.MODIFY
diff: @@ -84,6 +84,7 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path)
   ciss_url_t url;
   char cachepath[LONG_STRING];
   char mbox[LONG_STRING];
+  size_t len;
 
   if (path)
     imap_cachepath (idata, path, mbox, sizeof (mbox));
@@ -96,6 +97,12 @@ header_cache_t* imap_hcache_open (IMAP_DATA* idata, const char* path)
     FREE (&mx.mbox);
   }
 
+  if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
+    return NULL;
+  len = strlen(mbox);
+  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
+    return NULL;
+
   mutt_account_tourl (&idata->conn->account, &url);
   url.path = mbox;
   url_ciss_tostring (&url, cachepath, sizeof (cachepath), U_PATH);

programming_language: C
repo_url: https://github.com/neomutt/neomutt
commit_details: repo_url: https://github.com/neomutt/neomutt
author: Richard Russon
author_date: 2018-07-09 15:26:26+01:00
msg: Selectively cache headers

Co-authored-by: JerikoOne <jeriko.one@gmx.us>
repository: repo_url: https://github.com/neomutt/neomutt
repo_name: neomutt/neomutt
description: ✉️ Teaching an Old Dog New Tricks -- IRC: #neomutt on irc.libera.chat
repo_language: C
owner: neomutt
file_changes: filename: util.c
change_type: ModificationType.MODIFY
diff: @@ -245,6 +245,12 @@ header_cache_t *imap_hcache_open(struct ImapData *idata, const char *path)
     FREE(&mx.mbox);
   }
 
+  if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
+    return NULL;
+  size_t len = strlen(mbox);
+  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
+    return NULL;
+
   mutt_account_tourl(&idata->conn->account, &url);
   url.path = mbox;
   url_tostring(&url, cachepath, sizeof(cachepath), U_PATH);

programming_language: C