Subject: Re: NNCP path traversal attack.

From: John Goerzen <[email-masked]>
Date: Fri, 19 Sep 2025 07:02:41 -0500

Thank you for noticing and patching this, Eugene.

I have temporarily disabled freq on quux until I get it patched.

I will also work on getting a patched Debian package out.  I am pretty
busy through Sunday though, so it may be a couple of days.  I'm not sure
if Sergey is available; if not, I'll post a patched release on a git
system somewhere for ease of installation.

Question: do you believe there is also an absolute path (path beginning
with / ) weakness?  It looks like your patch would account for that also
though.

Thanks,

John

On Fri, Sep 19 2025, Eugene Medvedev wrote:

> As it currently stands, NNCP is vulnerable to path traversal attacks with
> freq and file functions: Despite the requirement for both to supply full path
> in configuration, both types of packets will accept and act upon paths
> containing
> "..". Most obviously, this allows one to request any file NNCP has access to,
> like its own configuration file with the private keys in it.
> Likewise, a sent file can break out of the incoming directory in the same manner
> and be written anywhere on the system that the user can write to.
>
> The included patch is my take on dealing with this by by limiting path
> traversal to
> below the configured full path. It does nothing about, e.g., symlinks,
> and I'm not sure anything should be done about those.
>
> I can't claim to understand the codebase sufficiently to have caught
> all the ways
> this can happen, however.