[Asterisk-code-review] manager.c: Prevent the Originate action from running the Originate app (asterisk[certified/16.3])

[Benjamin Keith Ford]

Benjamin Keith Ford has submitted this change. ( https://gerrit.asterisk.org/c/asterisk/+/13279 )

Change subject: manager.c:  Prevent the Originate action from running the Originate app
......................................................................

manager.c:  Prevent the Originate action from running the Originate app

If an AMI user without the "system" authorization calls the
Originate AMI command with the Originate application,
the second Originate could run the "System" command.

Action: Originate
Channel: Local/1111
Application: Originate
Data: Local/2222,app,System,touch /tmp/owned

If the "system" authorization isn't set, we now block the
Originate app as well as the System, Exec, etc. apps.

ASTERISK-28580
Reported by: Eliel Sardañons

Change-Id: Ic4c9dedc34c426f03c8c14fce334a71386d8a5fa
---
A doc/UPGRADE-staging/AMI-Originate.txt
M main/manager.c
2 files changed, 6 insertions(+), 0 deletions(-)

Approvals:
  Benjamin Keith Ford: Looks good to me, approved; Approved for Submit



diff --git a/doc/UPGRADE-staging/AMI-Originate.txt b/doc/UPGRADE-staging/AMI-Originate.txt
new file mode 100644
index 0000000..f2d3133
--- /dev/null
+++ b/doc/UPGRADE-staging/AMI-Originate.txt
@@ -0,0 +1,5 @@
+Subject: AMI
+
+The AMI Originate action, which optionally takes a dialplan application as
+an argument, no longer accepts "Originate" as the application due to
+security concerns.
diff --git a/main/manager.c b/main/manager.c
index 19b6aa2..fb89abb 100644
--- a/main/manager.c
+++ b/main/manager.c
@@ -5697,6 +5697,7 @@
 				                                     EAGI(/bin/rm,-rf /)       */
 				strcasestr(app, "mixmonitor") ||  /* MixMonitor(blah,,rm -rf)  */
 				strcasestr(app, "externalivr") || /* ExternalIVR(rm -rf)       */
+				strcasestr(app, "originate") ||   /* Originate(Local/1234,app,System,rm -rf) */
 				(strstr(appdata, "SHELL") && (bad_appdata = 1)) ||       /* NoOp(${SHELL(rm -rf /)})  */
 				(strstr(appdata, "EVAL") && (bad_appdata = 1))           /* NoOp(${EVAL(${some_var_containing_SHELL})}) */
 				)) {

-- 
To view, visit https://gerrit.asterisk.org/c/asterisk/+/13279
To unsubscribe, or for help writing mail filters, visit https://gerrit.asterisk.org/settings

Gerrit-Project: asterisk
Gerrit-Branch: certified/16.3
Gerrit-Change-Id: Ic4c9dedc34c426f03c8c14fce334a71386d8a5fa
Gerrit-Change-Number: 13279
Gerrit-PatchSet: 1
Gerrit-Owner: Benjamin Keith Ford <bford at digium.com>
Gerrit-Reviewer: Benjamin Keith Ford <bford at digium.com>
Gerrit-Reviewer: Friendly Automation
Gerrit-Reviewer: George Joseph <gjoseph at digium.com>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-code-review/attachments/20191121/8186e56d/attachment-0001.html>