[XS] Change in openvpn[master]: openvpnserv: harden CheckConfigPath() a bit more

cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/1886?usp=email )

Change subject: openvpnserv: harden CheckConfigPath() a bit more
......................................................................

openvpnserv: harden CheckConfigPath() a bit more

If the config_path retrieved from the Registry doesn't end with a path
sepatator, the prefix check could be satisfied by a sibling directory
that starts with the same substring, e.g. "config" vs. "configx". While
code in common.c ensures this, that code could disappear in the future
leaving the check vulnerable. Instead spend the few CPU cycles to be
absolutely sure, we're doing the right thing here.

Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.
Contributing Researcher: Vivek Parikh.

Reported-by: Vivek Parikh <[email protected]>
Tested-by: Vivek Parikh <[email protected]>
CVE: 2026-78043
Change-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182
Signed-off-by: Heiko Hund <[email protected]>
Acked-by: Razvan Cojocaru <[email protected]>
Acked-by: Arne Schwabe <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886
Message-Id: <[email protected]>
URL: https://www.mail-archive.com/[email protected]/msg38854.html
Signed-off-by: Gert Doering <[email protected]>
---
M src/openvpnserv/validate.c
1 file changed, 7 insertions(+), 1 deletion(-)




diff --git a/src/openvpnserv/validate.c b/src/openvpnserv/validate.c
index e3ef8b6..8e529b9 100644
--- a/src/openvpnserv/validate.c
+++ b/src/openvpnserv/validate.c
@@ -62,7 +62,13 @@
 {
     HRESULT res;
     WCHAR config_path[MAX_PATH];
+    const size_t config_dir_len = wcslen(s->config_dir);
 
+    /* config_dir must end with a '\' or the prefix check below could be satisfied by a sibling directory */
+    if (config_dir_len == 0 || s->config_dir[config_dir_len - 1] != L'\\')
+    {
+        return FALSE;
+    }
     /* fname = stdin is special: do not treat it as a relative path */
     if (wcscmp(fname, L"stdin") == 0)
     {
@@ -83,7 +89,7 @@
         res = PathCchCanonicalize(config_path, _countof(config_path), fname);
     }
 
-    return res == S_OK && wcsnicmp(config_path, s->config_dir, wcslen(s->config_dir)) == 0;
+    return res == S_OK && wcsnicmp(config_path, s->config_dir, config_dir_len) == 0;
 }
 
 

-- 
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1886?usp=email
To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email

Gerrit-MessageType: merged
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182
Gerrit-Change-Number: 1886
Gerrit-PatchSet: 2
Gerrit-Owner: cron2 <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-Reviewer: razvanc <[email protected]>
Gerrit-CC: d12fk <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel