iarv/znc
1
0
Fork 0
mirror of https://github.com/znc/znc.git synced 2026-03-28 17:42:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix RCE vulnerability in modtcl

Browse Source 
Remote attacker could execute arbitrary code embedded into the kick
reason while kicking someone on a channel.

To mitigate this for existing installations, simply unload the modtcl
module for every user, if it's loaded.
Note that only users with admin rights can load modtcl at all.

While at it, also escape the channel name.

Discovered by Johannes Kuhn (DasBrain)

Patch by https://github.com/glguy

CVE-2024-39844
This commit is contained in:
Alexey Sokolov
2024-07-01 09:59:16 +01:00
parent 9372430e2c
commit 8cbf8d6281
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
modules/modtcl.cpp
View File

@@ -248,8 +248,9 @@ class CModTcl : public CModule {
// chan specific
unsigned int nLength = vChans.size();
for (unsigned int n = 0; n < nLength; n++) {
CString sChannel = TclEscape(CString(vChans[n]->GetName()));
sCommand = "Binds::ProcessNick {" + sOldNick + "} {" + sHost +
"} - {" + vChans[n]->GetName() + "} {" + sNewNickTmp +
"} - {" + sChannel + "} {" + sNewNickTmp +
"}";
int i = Tcl_Eval(interp, sCommand.c_str());
if (i != TCL_OK) {
@@ -260,14 +261,16 @@ class CModTcl : public CModule {
void OnKick(const CNick& OpNick, const CString& sKickedNick, CChan& Channel,
const CString& sMessage) override {
CString sMes = TclEscape(sMessage);
CString sOpNick = TclEscape(CString(OpNick.GetNick()));
CString sNick = TclEscape(sKickedNick);
CString sOpHost =
TclEscape(CString(OpNick.GetIdent() + "@" + OpNick.GetHost()));
CString sChannel = TclEscape(Channel.GetName());
CString sCommand = "Binds::ProcessKick {" + sOpNick + "} {" + sOpHost +
"} - {" + Channel.GetName() + "} {" + sNick + "} {" +
sMessage + "}";
"} - {" + sChannel + "} {" + sNick + "} {" +
sMes + "}";
int i = Tcl_Eval(interp, sCommand.c_str());
if (i != TCL_OK) {
PutModule(Tcl_GetStringResult(interp));