From b178b9719bb2c98cf8a6db70065086f596afad81 Mon Sep 17 00:00:00 2001 From: Jaap Marcus <9754650+jaapmarcus@users.noreply.github.com> Date: Thu, 4 Aug 2022 18:18:04 +0200 Subject: [PATCH] Fix security issues in v-add-web-domain-redirect + Sync up main with release (#2814) * Fix v-add-web-domain-redirect * Remove sudo permission admin group on new setups We delete the group before install anyway * Block "sudo" from * Add missing slash * Update changelog * Update versions --- CHANGELOG.md | 22 +++++++++++++++++++++- README.md | 2 +- bin/v-add-user | 3 ++- bin/v-add-web-domain-redirect | 17 +++++++---------- install/hst-install-debian.sh | 2 +- install/hst-install-ubuntu.sh | 4 +++- install/upgrade/versions/1.6.7.sh | 22 ++++++++++++++++++++++ src/deb/hestia/control | 2 +- 8 files changed, 58 insertions(+), 16 deletions(-) create mode 100644 install/upgrade/versions/1.6.7.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index b98a908e72..127ff26f0b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,26 @@ # Changelog All notable changes to this project will be documented in this file. +## [1.6.6] - Service release + +### Bugfixes + +- Update DNS templates with CNAME for ftp, www and webmail (#2808) +- Fix name server A record validation error (#2807) +- Fixed issue with renaming domains and config files not properly removed (#2803) +- Add loading indicator after clicking save button (#2740) +- Improve hostname detection in mail-wrapper (#2805 @clarkchentw) + +### Security + +- Fixed an vulnerability in v-add-web-domain-redirect (CVE-2022-2636) +- Fixed an vulnerability in Ubuntu that can lead in privilege escalation for admin to root user (CVE-2022-2626) + +### Dependencies + +- Update Roundcube to 1.6.0 +- Update Dokuwiki to "2022-07-31" Igor (#2811) + ## [1.6.5] - Service release ### Bugfixes @@ -13,7 +33,7 @@ All notable changes to this project will be documented in this file. - Improve random bytes generator (#2774) - Don't allow /inc/2fa/secret.php called from the web browser directly (#2784 @mayappear) - Improve CSRF Origin Check Bypass (#2785 @mayappear) -- Fix vulnerability in Docuwiki Quick Install App @redstarp2 (CVE 2022-xxx-xxx) +- Fix vulnerability in Docuwiki Quick Install App @redstarp2 (CVE-2022-2550) ### Dependencies diff --git a/README.md b/README.md index ff43f0f967..5473bb654d 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ [Hestia Control Panel](https://www.hestiacp.com/) ================================================== -**Latest stable release:** Version 1.6.5 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp)
+**Latest stable release:** Version 1.6.6 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp)
**Web:** [www.hestiacp.com](https://www.hestiacp.com/)
**Documentation:** [docs.hestiacp.com](https://docs.hestiacp.com/)
diff --git a/bin/v-add-user b/bin/v-add-user index 7ee0b2a0a5..e4ef8500c3 100755 --- a/bin/v-add-user +++ b/bin/v-add-user @@ -31,8 +31,9 @@ source_conf "$HESTIA/conf/hestia.conf" is_user_free() { # these names may cause issues with MariaDB/MySQL database names and should be reserved: + # sudo has been added due to Privilege escalation as sudo group has always sudo permission check_sysuser=$(php -r '$reserved_names=array("aria", "aria_log", "mysql", "mysql_upgrade", "ib", "ib_buffer", - "ddl", "ddl_recovery", "performance"); if(in_array(strtolower($argv[1]), $reserved_names, true)){echo implode(", ", $reserved_names);}' "$user" ); + "ddl", "ddl_recovery", "performance", "sudo"); if(in_array(strtolower($argv[1]), $reserved_names, true)){echo implode(", ", $reserved_names);}' "$user" ); if [ -n "$check_sysuser" ]; then check_result "$E_INVALID" "The user name '$user' is reserved and cannot be used. List of reserved names: $check_sysuser" return diff --git a/bin/v-add-web-domain-redirect b/bin/v-add-web-domain-redirect index 4346716c74..742ccf07dc 100755 --- a/bin/v-add-web-domain-redirect +++ b/bin/v-add-web-domain-redirect @@ -42,21 +42,18 @@ is_object_unsuspended 'user' 'USER' "$user" is_object_valid 'web' 'DOMAIN' "$domain" is_object_unsuspended 'web' 'DOMAIN' "$domain" -scheme=0 if [[ "$3" =~ http://|https:// ]]; then scheme=1 - regex='(https?|ftp|file)://[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]' - if ! [[ "$3" =~ $regex ]]; then - echo "Invalid redirect" - exit 2; + isValidUrl=$(php -r '$url=$argv[1]; $url=filter_var($url,FILTER_VALIDATE_URL); echo $url;' "$3") + if [ -z "$isValidUrl" ]; then + check_result $E_INVALID "Invalid redirect" fi else - regex='[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]' - if ! [[ "$3" =~ $regex ]]; then - echo "Invalid redirect" - exit 2; + isValidUrl=$(php -r '$url=$argv[1]; $url=filter_var($url,FILTER_VALIDATE_URL); echo $url;' "http://$3") + if [ -z "$isValidUrl" ]; then + check_result $E_INVALID "Invalid redirect" fi -fi +fi # Perform verification if read-only mode is enabled check_hestia_demo_mode diff --git a/install/hst-install-debian.sh b/install/hst-install-debian.sh index cdad587ff9..8da0f767df 100755 --- a/install/hst-install-debian.sh +++ b/install/hst-install-debian.sh @@ -32,7 +32,7 @@ HESTIA_COMMON_DIR="$HESTIA/install/common" VERBOSE='no' # Define software versions -HESTIA_INSTALL_VER='1.6.6~alpha' +HESTIA_INSTALL_VER='1.6.7~alpha' # Dependencies multiphp_v=("5.6" "7.0" "7.1" "7.2" "7.3" "7.4" "8.0" "8.1") fpm_v="8.0" diff --git a/install/hst-install-ubuntu.sh b/install/hst-install-ubuntu.sh index 69516b9550..8099a70846 100755 --- a/install/hst-install-ubuntu.sh +++ b/install/hst-install-ubuntu.sh @@ -32,7 +32,7 @@ HESTIA_COMMON_DIR="$HESTIA/install/common" VERBOSE='no' # Define software versions -HESTIA_INSTALL_VER='1.6.6~alpha' +HESTIA_INSTALL_VER='1.6.7~alpha' # Dependencies multiphp_v=("5.6" "7.0" "7.1" "7.2" "7.3" "7.4" "8.0" "8.1") fpm_v="8.0" @@ -1335,6 +1335,8 @@ fi if [ -n "$(grep ^admin: /etc/group)" ] && [ "$force" = 'yes' ]; then groupdel admin > /dev/null 2>&1 fi +# Remove sudo "default" sudo permission admin user group should not exists any way +sed -i "s/%admin ALL=(ALL) ALL/#%admin ALL=(ALL) ALL/g" /etc/sudoers # Enable sftp jail echo "[ * ] Enable SFTP jail..." diff --git a/install/upgrade/versions/1.6.7.sh b/install/upgrade/versions/1.6.7.sh new file mode 100644 index 0000000000..1c46faf66b --- /dev/null +++ b/install/upgrade/versions/1.6.7.sh @@ -0,0 +1,22 @@ +#!/bin/bash + +# Hestia Control Panel upgrade script for target version 1.6.7 + +####################################################################################### +####### Place additional commands below. ####### +####################################################################################### +####### Pass through information to the end user in case of a issue or problem ####### +####### ####### +####### Use add_upgrade_message "My message here" to include a message ####### +####### in the upgrade notification email. Example: ####### +####### ####### +####### add_upgrade_message "My message here" ####### +####### ####### +####### You can use \n within the string to create new lines. ####### +####################################################################################### + +upgrade_config_set_value 'UPGRADE_UPDATE_WEB_TEMPLATES' 'no' +upgrade_config_set_value 'UPGRADE_UPDATE_DNS_TEMPLATES' 'no' +upgrade_config_set_value 'UPGRADE_UPDATE_MAIL_TEMPLATES' 'no' +upgrade_config_set_value 'UPGRADE_REBUILD_USERS' 'no' +upgrade_config_set_value 'UPGRADE_UPDATE_FILEMANAGER_CONFIG' 'false' \ No newline at end of file diff --git a/src/deb/hestia/control b/src/deb/hestia/control index e13d7842f0..3cd068fbd2 100644 --- a/src/deb/hestia/control +++ b/src/deb/hestia/control @@ -1,7 +1,7 @@ Source: hestia Package: hestia Priority: optional -Version: 1.6.6~alpha +Version: 1.6.7~alpha Section: admin Maintainer: HestiaCP Homepage: https://www.hestiacp.com