From patchwork Mon Aug 31 18:46:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5302 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:c317:b0:87d:ab56:3700 with SMTP id jk23csp3570617mab; Mon, 31 Aug 2026 11:47:29 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RpIkhLvsX4fHGftqZoqrwhGXE2u3OGdUr26A2HuladBHE8ACw4UTKFL37qHBvHhH8ZbC8jO1HpCYOk=@openvpn.net X-Received: by 2002:a05:6820:4c09:b0:6b1:a812:987b with SMTP id 006d021491bc7-6b372d5e291mr2957875eaf.14.1788202049315; Mon, 31 Aug 2026 11:47:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1788202049; cv=none; d=google.com; s=arc-20260327; b=pOQfhzpH5wfz8xoA/eZDDpNoQ/Ux257Jg63NcEDjQyUXwTHW035RdBFw6csAbzaMdQ HPMtNZX9WpHDAxeIvf3WCNur+p/wJ2AvT+YAV/ZMMIepuM6avRuhmBCFkpomrCBFC1Oh u34Jn5efBImwvhC+72RwEwHOsF6kyw6RNgmRBRfZOenfeu7Emg05m1bmWM/7YX19JMpz 5zdhPEi0/y0YGIIHkcZ0pdLALexYyUvUhSGNX/LTAJ7UkzAEPB2YIOq6vLk4pcU/HfCi EM5cbkrqU8BW+kDMd/V+W59Q3rZCB3eL79nVDS3wo6i+0RfUxMhtGRd4LNWpTBlsOQxY ozag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=WX+9OI9MyLsxInrQKULRZHBH/2fETEZ7wmndkqEijf4=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=kqRKQv71hI6H9mwtmHS2RNaArDggSFgQSPLIXpqeV8f46ptrsZeVqsPEkkP+6x3Fsg a/YUtu3oAHzq3gPKJ1I2bi3+ylH2e89CwM3Tajo361bktcIguiq154lhVZCeXZY8KpWp Gz389mY4/jwnL/eD2+q00LKT7S4Z69lNzZ/QMlzw7uOAKyOEpFwSt10lZ41UfOCQwIuS FBQKp0e+ry59XyyrzI8zzpj61AMpPNHD5EB0BCTa0hCJQc6AZWscXwr2qoFLNVzs9Cx2 ImMeW9IRLuXNAoIZrfB8LX2gzaRSFWDmWmsAbUVwFFt5vgJWNwV2s/FGltSwdt5c7I27 yOCg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="VTvACiD/"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=GQRtz7Pd; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=CUUUJn6S; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 006d021491bc7-6b1ce36f9f0si14819956eaf.67.2026.08.31.11.47.28 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 31 Aug 2026 11:47:29 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="VTvACiD/"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=GQRtz7Pd; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=CUUUJn6S; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=WX+9OI9MyLsxInrQKULRZHBH/2fETEZ7wmndkqEijf4=; b=VTvACiD/RiJrPMYHH+q1YPurm7 g8CX2nKJIVkBpw+8K6Tl/o1CKI0prWHttJ9lEB45seklCcpzOmpuT5RSj0lo7eIk4VAOhk0iH3Scs 64cpRFOLJC/xQz2JgJm0TGMWfQO9yI7KJS0JfDW53gHhXGellsWDzYgbgoetzukxzf3Y=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1x172P-0001rF-TS; Mon, 31 Aug 2026 18:47:21 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1x172C-0001r1-41 for openvpn-devel@lists.sourceforge.net; Mon, 31 Aug 2026 18:47:08 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=jeEbQyVdN45hLLWc0IyxnZq/fviD5eJi2l8fptZJt68=; b=GQRtz7Pdvt+WX6b2YQ+0ovIMxp XSDEIjjEuegUIii0PlF+tDpbeXjRBmj3bAVy8VQk7LMO0Ozndeep95j225ZnRmI8HTJIvjNDOTEBv GT0lJ3hd05Fw9G92aMJWYHG9aDRJOudwoWlbu36gOwhOmD3+vfiIF6JgfvULp0f++454=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=jeEbQyVdN45hLLWc0IyxnZq/fviD5eJi2l8fptZJt68=; b=CUUUJn6SLPVbz0049J0E36o4QT wqUTfej2MMLgEOXbXuBXmH/IwZwrnjRkvF7bGht+shyymYJvhHzd6uDonB59TQGMh1A0hrEhoxqqC oycEZ1G5188FCsvp1KOQXXr0N9wyqz1Xk4rDN5GDi/mlVAUieasDIzfw7pEgjmS32T8g=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1x1728-0004BC-VE for openvpn-devel@lists.sourceforge.net; Mon, 31 Aug 2026 18:47:08 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 67VIkvlL003347 for ; Mon, 31 Aug 2026 20:46:57 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 67VIkvh4003346 for openvpn-devel@lists.sourceforge.net; Mon, 31 Aug 2026 20:46:57 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Mon, 31 Aug 2026 20:46:50 +0200 Message-ID: <20260831184657.3332-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Heiko Hund Do not allow forward slashes in user provided config paths. The PathCch* functions do not treat them as path separators, leading to "/../" not being canonicalized. That, and the fact that Windows file [...] Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1x1728-0004BC-VE Subject: [Openvpn-devel] [PATCH v1] openvpnserv: don't allow '/' in config paths X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1875065752045993250 X-GMAIL-MSGID: 1875065752045993250 From: Heiko Hund Do not allow forward slashes in user provided config paths. The PathCch* functions do not treat them as path separators, leading to "/../" not being canonicalized. That, and the fact that Windows file APIs accept forward slashes leads to possible directory traversal. Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2. Contributing Researcher: Vivek Parikh. Reported-by: Vivek Parikh CVE: 2026-78043 Github: OpenVPN/openvpn-private-issues#162 Change-Id: I371aafba18d336bcfd3912e92c18301e39bf6087 Signed-off-by: Heiko Hund Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1885 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1885 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/src/openvpnserv/validate.c b/src/openvpnserv/validate.c index 7c0a87b..e3ef8b6 100644 --- a/src/openvpnserv/validate.c +++ b/src/openvpnserv/validate.c @@ -68,6 +68,11 @@ { return FALSE; } + /* do not accept forward slashes in paths, as PathCch* functions do not handle these */ + if (wcschr(workdir, L'/') || wcschr(fname, L'/')) + { + return FALSE; + } /* convert fname to full canonical path */ if (PathIsRelativeW(fname)) {