kodi: CVE-2017-5982: Unrestricted file download

Debian Bug report logs - #855225
kodi: CVE-2017-5982: Unrestricted file download

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: kodi: CVE-2017-5982: Unrestricted file download

Date: Wed, 15 Feb 2017 19:03:51 +0100

Source: kodi
Severity: important
Tags: upstream security
Forwarded: http://trac.kodi.tv/ticket/17314

Hi,

the following vulnerability was published for kodi. I did not had the
time to verify if 17.0 is affected. Could you please check and add
according found versions to this bug please or otherwise close after
checking?

CVE-2017-5982[0]:
local file inclusion

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-5982

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 855225@bugs.debian.org (full text, mbox, reply):

From: Bálint Réczey <balint@balintreczey.hu>

To: Salvatore Bonaccorso <carnil@debian.org>, 855225@bugs.debian.org

Subject: Re: Bug#855225: kodi: CVE-2017-5982: Unrestricted file download

Date: Wed, 15 Feb 2017 21:43:22 +0100

Control: tags -1 confirmed
Control: found -1 15.1+dfsg1-1


2017-02-15 19:03 GMT+01:00 Salvatore Bonaccorso <carnil@debian.org>:
> Source: kodi
> Severity: important
> Tags: upstream security
> Forwarded: http://trac.kodi.tv/ticket/17314
>
> Hi,
>
> the following vulnerability was published for kodi. I did not had the
> time to verify if 17.0 is affected. Could you please check and add
> according found versions to this bug please or otherwise close after
> checking?

Done.

Cheers,
Balint

>
> CVE-2017-5982[0]:
> local file inclusion
>
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
>
> For further information see:
>
> [0] https://security-tracker.debian.org/tracker/CVE-2017-5982
>
> Please adjust the affected versions in the BTS as needed.
>
> Regards,
> Salvatore

Message #19 received at 855225@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupre <anarcat@orangeseeds.org>

To: balint@balintreczey.hu, 855225@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>, control@bugs.debian.org

Subject: Re: Bug#855225: kodi: CVE-2017-5982: Unrestricted file download

Date: Wed, 26 Apr 2017 13:05:33 -0400

[Message part 1 (text/plain, inline)]

affects 85225 xbmc
package xbmc
found 85225 2:11.0~git20120510.82388d5-1
thanks

I can confirm this affects both jessie-backports and wheezy. I've been
able to access random files on my Kodi install using:

http://localhost:8080/image/image%3A%2F%2F%2e%2e%252f%2e%2e%252f%2e%2e%252f%2e%2e%252fetc%252fpasswd

Just add more %2e%2e%252f in there if that's not deep enough for you. :)

In wheezy, it's even worse - there's a /vfs/ layer that gives you plain
access to any given path, as bam discovered. But you don't even need any
"special://" protocol, this just works:

http://localhost:8080/vfs/etc/passwd

Given that XBMC 11 (wheezy) and 16 (jessie-backports) are vulnerable, I
would be very surprised if XBMC 13 had any reasonable protections in
place.

As I explained in this post on debian-lts, I'm really unsure how to fix
this issue:

https://lists.debian.org/87zif33oxf.fsf@curie.anarc.at

Should we consider this part of the design that there's basically an
open file manager in the Kodi web browser? That may sound ludicrous, but
that's the way this thing is built right now. There's *some* password
protection as well, although the password is empty by default and is
therefore disabled. A possible workaround would be to force
authentication, even if there are no passwords set. This would require
commenting out this line:

  m_needcredentials = !password.IsEmpty();

in CWebServer::SetCredentials (WebServer.cpp). That way attackers would
be presented with an authentication dialog at least. There's a default
username and password, but at this point we may somehow shift the blame
to the user...

The alternative here is to start enforcing path restrictions on the
requested files in the webserver. This is a difficult operation because,
right now, files can be specified with arbitrary paths, including
relative paths with `../` or absolute paths, and there aren't clear
boundaries to where Kodi "can look": Kodi is designed to take over a
media station and serve contents from all sorts of sources...

So if we change the webserver, we also need to change the callers, and
that could prove more difficult...

A.

[signature.asc (application/pgp-signature, inline)]

Message #28 received at 855225@bugs.debian.org (full text, mbox, reply):

From: Bálint Réczey <balint@balintreczey.hu>

To: Antoine Beaupre <anarcat@orangeseeds.org>

Cc: 855225@bugs.debian.org, Salvatore Bonaccorso <carnil@debian.org>, control <control@bugs.debian.org>

Subject: Re: Bug#855225: kodi: CVE-2017-5982: Unrestricted file download

Date: Fri, 28 Apr 2017 19:07:06 +0200

Hi Antoine,


Thanks for the detailed analysis!

2017-04-26 19:05 GMT+02:00 Antoine Beaupre <anarcat@orangeseeds.org>:
> affects 85225 xbmc
> package xbmc
> found 85225 2:11.0~git20120510.82388d5-1
> thanks
>
> I can confirm this affects both jessie-backports and wheezy. I've been
> able to access random files on my Kodi install using:
>
> http://localhost:8080/image/image%3A%2F%2F%2e%2e%252f%2e%2e%252f%2e%2e%252f%2e%2e%252fetc%252fpasswd
>
> Just add more %2e%2e%252f in there if that's not deep enough for you. :)
>
> In wheezy, it's even worse - there's a /vfs/ layer that gives you plain
> access to any given path, as bam discovered. But you don't even need any
> "special://" protocol, this just works:
>
> http://localhost:8080/vfs/etc/passwd
>
> Given that XBMC 11 (wheezy) and 16 (jessie-backports) are vulnerable, I
> would be very surprised if XBMC 13 had any reasonable protections in
> place.
>
> As I explained in this post on debian-lts, I'm really unsure how to fix
> this issue:
>
> https://lists.debian.org/87zif33oxf.fsf@curie.anarc.at
>
> Should we consider this part of the design that there's basically an
> open file manager in the Kodi web browser? That may sound ludicrous, but
> that's the way this thing is built right now. There's *some* password
> protection as well, although the password is empty by default and is
> therefore disabled. A possible workaround would be to force
> authentication, even if there are no passwords set. This would require
> commenting out this line:
>
>   m_needcredentials = !password.IsEmpty();
>
> in CWebServer::SetCredentials (WebServer.cpp). That way attackers would
> be presented with an authentication dialog at least. There's a default
> username and password, but at this point we may somehow shift the blame
> to the user...
>
> The alternative here is to start enforcing path restrictions on the
> requested files in the webserver. This is a difficult operation because,
> right now, files can be specified with arbitrary paths, including
> relative paths with `../` or absolute paths, and there aren't clear
> boundaries to where Kodi "can look": Kodi is designed to take over a
> media station and serve contents from all sorts of sources...
>
> So if we change the webserver, we also need to change the callers, and
> that could prove more difficult...

I have forwarded this info to upstream bug tracker but I have no high hopes in
getting the issue solved.

I plan blogging about Kodi 17.1 being in both Stretch and Zesty and mention
this issue as a reason for people to not trust any installation too much.

Cheers,
Balint

Message #33 received at 855225@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupré <anarcat@orangeseeds.org>

To: balint@balintreczey.hu

Cc: 855225@bugs.debian.org, Salvatore Bonaccorso <carnil@debian.org>

Subject: Re: Bug#855225: kodi: CVE-2017-5982: Unrestricted file download

Date: Sat, 29 Apr 2017 10:47:59 -0400

On 2017-04-28 19:07:06, Bálint Réczey wrote:

[...]

> I have forwarded this info to upstream bug tracker but I have no high hopes in
> getting the issue solved.
>
> I plan blogging about Kodi 17.1 being in both Stretch and Zesty and mention
> this issue as a reason for people to not trust any installation too much.

Thanks!

I'll also mention this in my report, hopefully this will get some
traction...

A.

-- 
Choose a job you love and you will never have to work a day in your
life.
                         - Confucius

Send a report that this bug log contains spam.