Comments (5)
- What is this bug? Can a malicious server admin force a shared object file to download and execute arbitrary code as shown in the video?
Yes. I did that in the video :)
- What versions of ezquake / mvdsv / ktx are affected by this bug?
mvdsv filters the download command. Think only special admins can download files directly under /qw/*
so it would take some more injection trickery to authenticate the user as such which is why I instead used FTE to serve for the demo.
I can see a scenario where the server has a simple rcon, a stufftext sets that rcon in the client and auths the user towards the server, at which point the download is stuffed, but at that point it's just easier to recompile the server code.
mvdsv and ktx have zero blame here, just made it a bit easier to do this without changing the code, thus making it a good proof of concept of a shared server where many people can upload to a /qw/*
directory via ftp/sftp/http, but otherwise have no control over the server.
If you have total control of the server you can just send such stufftexts directly with any content you want, just requires compiling a new version and I wanted to limit myself to prebuilt binaries usecase.
So while this demo has a somewhat rarepepe server side setup, the fact remains that you have no idea who answers on the other side when you connect, and the vulnerability is on the client side.
from ezquake-source.
Wow. This looks pretty bad! Thanks @dsvensson for finding this and for @namtsui for bringing this to my attention.
I've just submitted an update for games/mvdsv to OpenBSD ports and now with the DIST_TUPLE
mechanism, I can update ezquake to the latest as well.
from ezquake-source.
I've submitted an update to the OpenBSD ports mailing list. Hopefully it will be committed soon.
from ezquake-source.
Related Issues (20)
- Revisit vid_grab_keyboard defaults/documentation on Windows
- REQ: Viewsize Texture ( possible to change to full Black? )
- BUG: macOS bundle creation is broken HOT 1
- Comand "menu_ingame 0" not working
- BUG: unable to build windows binaries under linux HOT 2
- BUG: vid_software_palette 1 causes black screen when moving game window around HOT 2
- BUG: Interpolation not working correctly for r_drawviewmodel 1 with vid_renderer 0 HOT 1
- BUG: load game menu does not populate with saved games HOT 2
- BUG: randomly attack command does not work after starting new game HOT 3
- BUG: pcre2 port broke font listing HOT 2
- BUG: vfspak_seek warning on map change HOT 3
- REQ: Make /teamlock affect 1on1 (regarding skins) HOT 1
- BUG: glitchy text in the console HOT 3
- BUG: amd - leaks from flashblend when gl_outline is enabled HOT 4
- BUG: ezquake hangs on loading gpl maps in gpl maps pk3 HOT 3
- REQ: cfg_SAVE all unbinded keys (except escape, not usable)
- REQ: add options to scr_conback HOT 1
- BUG: Unspecific missing surfaces HOT 7
- BUG: Server specific commands registered when in client mode HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ezquake-source.