ZNC crashing when unloading *admin via *admin #121

New Issue

2026-10-05T04:00:02+02:00

adam commented

2026-10-05 04:00:02 +02:00

Hi,

we can reproduce this with the latest 206 package from epel-repositories on centos 6.2 (up to date).

When a user (does not matter if role is admin or normal user), unloads the *admin module for him/herself in a opened query in the admin-module itself, the ZNC process will close on the machine.

So, every user is able to crash a whole znc instance just by this.

unloading other modules via *admin works without problems, and *admin can be unloaded in *status, too.

Just unloading *admin in itself will crash all.

Global Config Options:

AnonIPLimit  = 10
MaxBufferSize= 500
SSLCertFile  = /var/lib/znc/znc.pem
ProtectWebSessions = true
Listener     = +1337
ConnectDelay = 5
ServerThrottle = 30
Skin         = dark-clouds
StatusPrefix = *
Motd         = Yo, whatup?
BindHost     = 0.0.0.0
LoadModule   = webadmin
LoadModule   = lastseen
LoadModule   = partyline
LoadModule   = identfile

An example for my user:

<User moodydeath>
        Pass = willnottellyouthis;-)
        Nick = moodydeath
        AltNick = moodydeath
        Ident = moodydeath
        RealName = moodydeath
        BindHost = 0.0.0.0
        QuitMsg = blubb!
        ChanModes = +stn
        Buffer = 500
        KeepBuffer = true
        MultiClients = true
        DenyLoadMod = false
        Admin = true
        DenySetBindHost = true
        TimestampFormat = [%H:%M:%S]
        AppendTimestamp = false
        PrependTimestamp = true
        TimezoneOffset = 0.00
        JoinTries = 10
        MaxJoins = 5
        IRCConnectEnabled = true

        Allow = *

        LoadModule = chansaver
        LoadModule = clientnotify
        LoadModule = disconkick
        LoadModule = keepnick
        LoadModule = kickrejoin
        LoadModule = q
        LoadModule = savebuff
        LoadModule = schat
        LoadModule = simple_away
        LoadModule = stickychan
        LoadModule = admin
        LoadModule = awaynick

        Server = someserver 6667

        <Chan #somechannel>
        </Chan>
</User>

Hi, we can reproduce this with the latest 206 package from epel-repositories on centos 6.2 (up to date). When a user (does not matter if role is admin or normal user), unloads the *admin module for him/herself in a opened query in the admin-module itself, the ZNC process will close on the machine. So, every user is able to crash a whole znc instance just by this. unloading other modules via *admin works without problems, and *admin can be unloaded in *status, too. Just unloading *admin in itself will crash all. Global Config Options: ``` AnonIPLimit = 10 MaxBufferSize= 500 SSLCertFile = /var/lib/znc/znc.pem ProtectWebSessions = true Listener = +1337 ConnectDelay = 5 ServerThrottle = 30 Skin = dark-clouds StatusPrefix = * Motd = Yo, whatup? BindHost = 0.0.0.0 LoadModule = webadmin LoadModule = lastseen LoadModule = partyline LoadModule = identfile ``` An example for my user: ``` <User moodydeath> Pass = willnottellyouthis;-) Nick = moodydeath AltNick = moodydeath Ident = moodydeath RealName = moodydeath BindHost = 0.0.0.0 QuitMsg = blubb! ChanModes = +stn Buffer = 500 KeepBuffer = true MultiClients = true DenyLoadMod = false Admin = true DenySetBindHost = true TimestampFormat = [%H:%M:%S] AppendTimestamp = false PrependTimestamp = true TimezoneOffset = 0.00 JoinTries = 10 MaxJoins = 5 IRCConnectEnabled = true Allow = * LoadModule = chansaver LoadModule = clientnotify LoadModule = disconkick LoadModule = keepnick LoadModule = kickrejoin LoadModule = q LoadModule = savebuff LoadModule = schat LoadModule = simple_away LoadModule = stickychan LoadModule = admin LoadModule = awaynick Server = someserver 6667 <Chan #somechannel> </Chan> </User> ```

adam closed this issue

2026-10-05 04:00:02 +02:00

adam commented

2026-10-05 04:00:03 +02:00

can reproduce it in the master branch as well on a self compiled module.

a quick fix as some kind of "workaround" is, to add this to the if-clauses (i just inserted it after the empty-check) in admin.cpp:

        if (sModName == "admin") {
            PutModule("Cannot unload *admin within itself");
            return;
        }

This will just deny the unload of the module itself - so it has to be unloaded via *status ... for me it's enough at the moment, but it still does not fix the problem of modules unloading themself.

can reproduce it in the master branch as well on a self compiled module. a quick fix as some kind of "workaround" is, to add this to the if-clauses (i just inserted it after the empty-check) in admin.cpp: ``` if (sModName == "admin") { PutModule("Cannot unload *admin within itself"); return; } ``` This will just deny the unload of the module itself - so it has to be unloaded via *status ... for me it's enough at the moment, but it still does not fix the problem of modules unloading themself.

adam commented

2026-10-05 04:00:04 +02:00

Thanks for finding this @moodydeath. I checked webadmin and that handles this fine and wont let you unload itself.

Thanks for finding this @moodydeath. I checked webadmin and that handles this fine and wont let you unload itself.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#121