public inbox for nncp-devel@lists.stargrave.org
Atom feed

From: John Goerzen <jgoerzen@complete•org>
To: Eugene Medvedev <rn3aoh.g@gmail•com>
Cc: nncp-devel@lists.cypherpunks.su
Subject: Re: NNCP path traversal attack.
Date: Fri, 19 Sep 2025 07:02:41 -0500	[thread overview]
Message-ID: <87v7leira6.fsf@complete.org> (raw)
In-Reply-To: <CAO-d-4p-xZjB=zAri=y-H-KPziVYGwnC70zKQ8vsEHzJTvDGsg@mail.gmail.com> (Eugene Medvedev's message of "Fri, 19 Sep 2025 07:46:20 +0300")

Thank you for noticing and patching this, Eugene.

I have temporarily disabled freq on quux until I get it patched.

I will also work on getting a patched Debian package out.  I am pretty
busy through Sunday though, so it may be a couple of days.  I'm not sure
if Sergey is available; if not, I'll post a patched release on a git
system somewhere for ease of installation.

Question: do you believe there is also an absolute path (path beginning
with / ) weakness?  It looks like your patch would account for that also
though.

Thanks,

John

On Fri, Sep 19 2025, Eugene Medvedev wrote:

> As it currently stands, NNCP is vulnerable to path traversal attacks with
> freq and file functions: Despite the requirement for both to supply full path
> in configuration, both types of packets will accept and act upon paths
> containing
> "..". Most obviously, this allows one to request any file NNCP has access to,
> like its own configuration file with the private keys in it.
> Likewise, a sent file can break out of the incoming directory in the same manner
> and be written anywhere on the system that the user can write to.
>
> The included patch is my take on dealing with this by by limiting path
> traversal to
> below the configured full path. It does nothing about, e.g., symlinks,
> and I'm not sure anything should be done about those.
>
> I can't claim to understand the codebase sufficiently to have caught
> all the ways
> this can happen, however.

next prev parent reply	other threads:[~2025-09-19 12:20 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-09-19  4:46 NNCP path traversal attack Eugene Medvedev
2025-09-19  6:28 ` Jonathan Lane
2025-09-19  6:43   ` Eugene Medvedev
2025-09-19 12:02 ` John Goerzen [this message]
2025-09-19 12:11   ` Eugene Medvedev
2025-09-19 12:04 ` John Goerzen
2025-09-19 12:31   ` Eugene Medvedev
2025-09-19 13:25 ` Sergey Matveev
2025-09-19 13:30   ` Eugene Medvedev