1bf3dfffd7
An admin can configure app_minivm with an externnotify program to be run when a voicemail is received. The app_minivm application MinivmNotify uses ast_safe_system() for this purpose which is vulnerable to command injection since the Caller-ID name and number values given to externnotify can come from an external untrusted source. * Add ast_safe_execvp() function. This gives modules the ability to run external commands with greater safety compared to ast_safe_system(). Specifically when some parameters are filled by untrusted sources the new function does not allow malicious input to break argument encoding. This may be of particular concern where CALLERID(name) or CALLERID(num) may be used as a parameter to a script run by ast_safe_system() which could potentially allow arbitrary command execution. * Changed app_minivm.c:run_externnotify() to use the new ast_safe_execvp() instead of ast_safe_system() to avoid command injection. * Document code injection potential from untrusted data sources for other shell commands that are under user control. ASTERISK-27103 Change-Id: I7552472247a84cde24e1358aaf64af160107aef1
125 lines
3.5 KiB
C
125 lines
3.5 KiB
C
/*
|
|
* Asterisk -- An open source telephony toolkit.
|
|
*
|
|
* Copyright (C) 2006-2012, Digium, Inc.
|
|
*
|
|
* See http://www.asterisk.org for more information about
|
|
* the Asterisk project. Please do not directly contact
|
|
* any of the maintainers of this project for assistance;
|
|
* the project provides a web site, mailing lists and IRC
|
|
* channels for your use.
|
|
*
|
|
* This program is free software, distributed under the terms of
|
|
* the GNU General Public License Version 2. See the LICENSE file
|
|
* at the top of the source tree.
|
|
*/
|
|
|
|
/*! \file
|
|
*
|
|
* SHELL function to return the output generated by a command issued to the system shell.
|
|
*
|
|
* \note Inspiration and Guidance from Russell! Thank You!
|
|
*
|
|
* \author Brandon Kruse <bkruse@digium.com>
|
|
*
|
|
* \ingroup functions
|
|
*/
|
|
|
|
/*** MODULEINFO
|
|
<support_level>core</support_level>
|
|
***/
|
|
|
|
#include "asterisk.h"
|
|
|
|
#include "asterisk/module.h"
|
|
#include "asterisk/channel.h"
|
|
#include "asterisk/pbx.h"
|
|
#include "asterisk/utils.h"
|
|
#include "asterisk/app.h"
|
|
|
|
static int shell_helper(struct ast_channel *chan, const char *cmd, char *data,
|
|
char *buf, size_t len)
|
|
{
|
|
int res = 0;
|
|
|
|
if (ast_strlen_zero(data)) {
|
|
ast_log(LOG_WARNING, "Missing Argument! Example: Set(foo=${SHELL(echo \"bar\")})\n");
|
|
return -1;
|
|
}
|
|
|
|
if (chan) {
|
|
ast_autoservice_start(chan);
|
|
}
|
|
|
|
if (len >= 1) {
|
|
FILE *ptr;
|
|
char plbuff[4096];
|
|
|
|
ptr = popen(data, "r");
|
|
if (ptr) {
|
|
while (fgets(plbuff, sizeof(plbuff), ptr)) {
|
|
strncat(buf, plbuff, len - strlen(buf) - 1);
|
|
}
|
|
pclose(ptr);
|
|
} else {
|
|
ast_log(LOG_WARNING, "Failed to execute shell command '%s'\n", data);
|
|
res = -1;
|
|
}
|
|
}
|
|
|
|
if (chan) {
|
|
ast_autoservice_stop(chan);
|
|
}
|
|
|
|
return res;
|
|
}
|
|
|
|
/*** DOCUMENTATION
|
|
<function name="SHELL" language="en_US">
|
|
<synopsis>
|
|
Executes a command using the system shell and captures its output.
|
|
</synopsis>
|
|
<syntax>
|
|
<parameter name="command" required="true">
|
|
<para>The command that the shell should execute.</para>
|
|
<warning><para>Do not use untrusted strings such as <variable>CALLERID(num)</variable>
|
|
or <variable>CALLERID(name)</variable> as part of the command parameters. You
|
|
risk a command injection attack executing arbitrary commands if the untrusted
|
|
strings aren't filtered to remove dangerous characters. See function
|
|
<variable>FILTER()</variable>.</para></warning>
|
|
</parameter>
|
|
</syntax>
|
|
<description>
|
|
<para>Collects the output generated by a command executed by the system shell</para>
|
|
<para>Example: <literal>Set(foo=${SHELL(echo bar)})</literal></para>
|
|
<note>
|
|
<para>The command supplied to this function will be executed by the
|
|
system's shell, typically specified in the SHELL environment variable. There
|
|
are many different system shells available with somewhat different behaviors,
|
|
so the output generated by this function may vary between platforms.</para>
|
|
|
|
<para>If <literal>live_dangerously</literal> in <literal>asterisk.conf</literal>
|
|
is set to <literal>no</literal>, this function can only be executed from the
|
|
dialplan, and not directly from external protocols.</para>
|
|
</note>
|
|
</description>
|
|
|
|
</function>
|
|
***/
|
|
static struct ast_custom_function shell_function = {
|
|
.name = "SHELL",
|
|
.read = shell_helper,
|
|
};
|
|
|
|
static int unload_module(void)
|
|
{
|
|
return ast_custom_function_unregister(&shell_function);
|
|
}
|
|
|
|
static int load_module(void)
|
|
{
|
|
return ast_custom_function_register_escalating(&shell_function, AST_CFE_READ);
|
|
}
|
|
|
|
AST_MODULE_INFO_STANDARD(ASTERISK_GPL_KEY, "Collects the output generated by a command executed by the system shell");
|