diff mbox series

[Openvpn-devel,v1] openvpnserv: harden CheckConfigPath() a bit more

Message ID 20260831184709.3359-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v1] openvpnserv: harden CheckConfigPath() a bit more |

Commit Message

Gert Doering Aug. 31, 2026, 6:47 p.m. UTC 
  From: Heiko Hund <heiko@ist.eigentlich.net>

If the config_path retrieved from the Registry doesn't end with a path
sepatator, the prefix check could be satisfied by a sibling directory
that starts with the same substring, e.g. "config" vs. "configx". While
code in common.c ensures this, that code could disappear in the future
leaving the check vulnerable. Instead spend the few CPU cycles to be
absolutely sure, we're doing the right thing here.

Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.
Contributing Researcher: Vivek Parikh.

Reported-by: Vivek Parikh <vivek.parikh@breachx.ai>
CVE: 2026-78043
Change-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182
Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886
This mail reflects revision 1 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>

Comments

Gert Doering Sept. 1, 2026, 12:37 p.m. UTC | #1 
Path validation is hard...  thanks for taking this on, and fixing yet
another round of possible angles of attack.

Your patch has been applied to the master and release/2.7 branch.

The 2.6 codebase is sufficiently different here (and already fixed).

commit 588af513aac1d2d774fd3fde1716384e3501a5a1 (master)
commit f6621b1316970866cff9c711217b0fce5fe41d16 (release/2.7)
Author: Heiko Hund
Date:   Mon Aug 31 20:47:04 2026 +0200

     openvpnserv: harden CheckConfigPath() a bit more

     Signed-off-by: Heiko Hund <heiko@ist.eigentlich.net>
     Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
     Acked-by: Arne Schwabe <arne@rfc2549.org>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886
     Message-Id: <20260831184709.3359-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38854.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/src/openvpnserv/validate.c b/src/openvpnserv/validate.c
index e3ef8b6..8e529b9 100644
--- a/src/openvpnserv/validate.c
+++ b/src/openvpnserv/validate.c
@@ -62,7 +62,13 @@ 
 {
     HRESULT res;
     WCHAR config_path[MAX_PATH];
+    const size_t config_dir_len = wcslen(s->config_dir);
 
+    /* config_dir must end with a '\' or the prefix check below could be satisfied by a sibling directory */
+    if (config_dir_len == 0 || s->config_dir[config_dir_len - 1] != L'\\')
+    {
+        return FALSE;
+    }
     /* fname = stdin is special: do not treat it as a relative path */
     if (wcscmp(fname, L"stdin") == 0)
     {
@@ -83,7 +89,7 @@ 
         res = PathCchCanonicalize(config_path, _countof(config_path), fname);
     }
 
-    return res == S_OK && wcsnicmp(config_path, s->config_dir, wcslen(s->config_dir)) == 0;
+    return res == S_OK && wcsnicmp(config_path, s->config_dir, config_dir_len) == 0;
 }