openwrt-mirror/luci
1
0
Fork 0
mirror of https://github.com/openwrt/luci.git synced 2026-04-12 14:03:24 +04:00
Code Issues Packages Projects Releases Wiki Activity

luci-proto-modemmanager: fix ACL command injection

Browse Source 
The ACL permissions were originally authored to support just a single
set of modem interfaces, at the numbers 0-9.  Eventually this was
adjusted to support from 0 to 999 avoiding command injection.

However, as new commands were added, this was reverted again
unfortunately. Language like "regex" has been used in the commit history
for this ACL, and likely the core of the issue is confusion on how these
are parsed.  These are all parsed [1] with fnmatch(...), and not regex(..).

A future useful change could be for rpcd to set the FNM_EXTMATCH option
for fnmatch(...) to simplify this particular match statement, but that's
not considered here since that's a much broader change that needs a
longer discussion.

[1] a4a5a29858/session.c (L143-L147)

Fixes: 54aa70112c ("luci-proto-modemmanager: add status page")
Signed-off-by: Tim Nordell <tnordell@airgain.com>
This commit is contained in:
Tim Nordell
2026-03-16 09:24:23 -05:00
committed by Florian Eckert
parent ba590f87ea
commit 122839294a
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
protocols/luci-proto-modemmanager/root/usr/share/rpcd/acl.d/luci-proto-modemmanager.json
View File

@@ -5,9 +5,24 @@
"cgi-io": [ "exec" ],
"file": {
"/usr/bin/mmcli -L -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9]* -J": [ "exec" ],
"/usr/bin/mmcli -i [0-9]* -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9]* --location-get -J": [ "exec" ]
"/usr/bin/mmcli -m [0-9] -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9][0-9] -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9][0-9][0-9] -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9][0-9][0-9][0-9] -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9][0-9][0-9][0-9][0-9] -J": [ "exec" ],
"/usr/bin/mmcli -i [0-9] -J": [ "exec" ],
"/usr/bin/mmcli -i [0-9][0-9] -J": [ "exec" ],
"/usr/bin/mmcli -i [0-9][0-9][0-9] -J": [ "exec" ],
"/usr/bin/mmcli -i [0-9][0-9][0-9][0-9] -J": [ "exec" ],
"/usr/bin/mmcli -i [0-9][0-9][0-9][0-9][0-9] -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9] --location-get -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9][0-9] --location-get -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9][0-9][0-9] --location-get -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9][0-9][0-9][0-9] --location-get -J": [ "exec" ],
"/usr/bin/mmcli -m [0-9][0-9][0-9][0-9][0-9] --location-get -J": [ "exec" ]
}
}
}