1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
From f2df8e3ea21ae25be03fd4dc87a284cc44619dc4 Mon Sep 17 00:00:00 2001
From: Eugene Medvedev <rn3aoh.g@gmail.com>
Date: Fri, 19 Sep 2025 16:12:18 +0300
Subject: [PATCH] Prevent path traversal during freq/file
As it currently stands, NNCP is vulnerable to path traversal attacks with
freq and file functions: Despite the requirement for both to supply full path
in configuration, both types of packets will accept and act upon paths containing
"..". Most obviously, this allows one to request any file NNCP has access to,
like its own configuration file with the private keys in it.
Likewise, a sent file can break out of the incoming directory in the same manner
and be written anywhere on the system that the user can write to.
This patch is my take on dealing with this by by limiting path traversal to
below the configured full path. It does nothing about, e.g., symlinks,
and I'm not sure anything should be done about those.
---
src/toss.go | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
--- a/src/toss.go
+++ b/src/toss.go
@@ -273,6 +273,17 @@ func jobProcess(
return err
}
dir := filepath.Join(*incoming, path.Dir(dst))
+ if !strings.HasPrefix(dir, *incoming) {
+ err = errors.New("incoming path traversal")
+ ctx.LogE("rx-traversal", les, err, func(les LEs) string {
+ return fmt.Sprintf(
+ "Tossing file %s/%s (%s): %s: traversal",
+ sender.Name, pktName,
+ humanize.IBytes(pktSize), dst,
+ )
+ })
+ return err
+ }
if err = os.MkdirAll(dir, os.FileMode(0777)); err != nil {
ctx.LogE("rx-mkdir", les, err, func(les LEs) string {
return fmt.Sprintf(
@@ -503,11 +514,26 @@ func jobProcess(
)
return err
}
+ srcPath := filepath.Join(*freqPath, src)
+ if !strings.HasPrefix(srcPath, *freqPath) {
+ err = errors.New("freqing path traversal")
+ ctx.LogE(
+ "rx-no-freq", les, err,
+ func(les LEs) string {
+ return fmt.Sprintf(
+ "Tossing freq %s/%s (%s): %s -> %s",
+ sender.Name, pktName,
+ humanize.IBytes(pktSize), src, dst,
+ )
+ },
+ )
+ return err
+ }
if !dryRun {
err = ctx.TxFile(
sender,
pkt.Nice,
- filepath.Join(*freqPath, src),
+ srcPath,
dst,
sender.FreqChunked,
sender.FreqMinSize,
|
