From: Christopher Ertl <Christopher.Ertl@microsoft.com>
To: "git@vger.kernel.org" <git@vger.kernel.org>
Subject: Windows absolute drive path detection incomplete
Date: Thu, 8 Aug 2019 16:44:52 +0000 [thread overview]
Message-ID: <DB7PR83MB0268816EF2F435EF791272C197D70@DB7PR83MB0268.EURPRD83.prod.outlook.com> (raw)
Hi,
I'd like to report a problem with path validation for Windows, and propose a fix.
Function `verify_path` first calls `has_dos_drive_prefix` in order to prevent absolute drive paths like "C:\xxx". The logic for that is implemented as follows:
#define has_dos_drive_prefix(path) \
(isalpha(*(path)) && (path)[1] == ':' ? 2 : 0)
The problem is that Windows will still interpret a path like this as an absolute drive path even if the first character isn't alpha, and so it should still be rejected.
In fact, it's actually possible to create drives like that which bypass this filter on Windows (as Administrator), even if it's not an officially supported feature:
>subst 1: C:\Users\x\Desktop
>dir 1:
...
Directory of 1:\
08/06/2019 06:19 PM <DIR> .
08/06/2019 06:19 PM <DIR> ..
...
With a drive like this present, a malicious server can write to wherever that drive points when you perform a git clone (to test this, just create a git repository containing :1/file):
>git clone http://x/pathtest
Cloning into 'pathtest'...
>dir pathtest
...
Directory of pathtest
08/08/2019 04:49 PM <DIR> .
08/08/2019 04:49 PM <DIR> ..
0 File(s) 0 bytes
>dir C:\Users\x\Desktop
...
Directory of C:\Users\x\Desktop
08/08/2019 04:49 PM 9 file
If the drive doesn't exist, the clone will fail anyway:
>dir 1:
The system cannot find the path specified.
>git clone http://x/pathtest
Cloning into 'pathtest'...
fatal: cannot create directory at '1:': No such file or directory
warning: Clone succeeded, but checkout failed.
You can inspect what was checked out with 'git status'
and retry the checkout with 'git checkout -f HEAD'
So I'm proposing to remove the check for the drive letter being alpha in `has_dos_drive_prefix` macro:
#define has_dos_drive_prefix(path) \
( (path)[1] == ':' ? 2 : 0)
As well as being a security patch for RCE under very unlikely circumstance, this patch is also a micro performance boost!
Thanks,
Christopher Ertl | MSRC Vulnerabilities & Mitigations | Microsoft Limited
Microsoft Limited (company number 01624297) is a company registered in England and Wales whose registered office is at Microsoft Campus, Thames Valley Park, Reading. RG6 1WG
next reply other threads:[~2019-08-08 16:44 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-08 16:44 Christopher Ertl [this message]
2019-08-08 16:50 ` Windows absolute drive path detection incomplete Eric Sunshine
2019-08-08 16:58 ` Christopher Ertl
2019-08-09 0:22 ` brian m. carlson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DB7PR83MB0268816EF2F435EF791272C197D70@DB7PR83MB0268.EURPRD83.prod.outlook.com \
--to=christopher.ertl@microsoft.com \
--cc=git@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).