openwrt-mirror/luci
1
0 Fork 0
mirror of https://github.com/openwrt/luci.git synced 2026-10-12 05:07:26 +04:00
Code Issues Packages Projects Releases Wiki Activity

luci-proto-openvpn: fix shell code injection through gerateKey arg

Browse Source 
Ensure to quote the `cl_meta` argument of the `gerateKey` procedure.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich committed 2026-06-28 01:34:39 +02:00
1 parent b45584b4e6
commit e4ff45ecbc
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
protocols/luci-proto-openvpn/root/usr/share/rpcd/ucode/luci.openvpn.uc
+1 -1
View File
@@ -68,7 +68,7 @@ const methods = {
// denote which server key this client key is derived from in the name
path = `${mkpath}/${ifname}_${kt}_${ts}-${req.args?.server_key}`;
cmd = `${openvpn} --tls-crypt-v2 ${shellquote(server_key)} --genkey tls-crypt-v2-client ${shellquote(path)} ${req.args?.cl_meta} 2>/dev/null`;
cmd = `${openvpn} --tls-crypt-v2 ${shellquote(server_key)} --genkey tls-crypt-v2-client ${shellquote(path)} ${shellquote(req.args?.cl_meta)} 2>/dev/null`;
} else {
// basic genkey
cmd = `${openvpn} --genkey ${kt} ${shellquote(path)} 2>/dev/null`;