REDHAT-BUG-2280726: Medium severity pagure vulnerability

Description of problem: In issues.py, viewissuerawfile() services issues attachments from pagureconfig["ATTACHMENTSFOLDER"]. The requested filename comes directly from the URL and is concatenated with the attachments folder and the repository name.

@UINS.route("/<repo>/issue/raw/<path:filename>") @UINS.route("/<namespace>/<repo>/issue/raw/<path:filename>") @UINS.route("/fork/<username>/<repo>/issue/raw/<path:filename>") @UINS.route("/fork/<username>/<namespace>/<repo>/issue/raw/<path:filename>") @hasissuetracker def viewissuerawfile(repo, filename=None, username=None, namespace=None): # [...] attachdir = os.path.join( pagureconfig["ATTACHMENTSFOLDER"], repo.fullname ) attachpath = os.path.join(attachdir, filename) if not os.path.exists(attachpath): # [...] # At this moment, attachpath exists and points to the file with open(attachpath, "rb") as f: data = f.read() # [...] return (data, 200, pagure.lib.mimetype.gettypeheaders(filename, data))

The "path" routing converter accepts all characters, including slashes and thus also directory traversal sequences.

Version-Release number of selected component (if applicable): Introduced with commit 96c928b in release 3.0, and verified on latest commit as of today (fe91f76).

How reproducible: This bug can be reproduced on the latest development version of Pagure; see steps below.

It is important to note that reverse-proxies in front of Pagure can thwart exploitation attemps depending on their configuration, as they often try to normalize the URL. This is not a security feature and it shouldn't be relied upon.

I could demonstrate it locally but not on stg.pagure.io after succint tests.

Steps to Reproduce: 1. Create a new repository; 2. Go to "Settings", "Project Options" and make sure that "Issue tracker" is ticked; 3. Run the command curl --path-as-is 'http://pagure.local:5000/your-repository/issue/raw/../../../../../../../etc/passwd'.

Actual results: On my test instance, the content of /etc/passwd is shown.

Expected results: Only files under the intended attachments folder should be served.

Additional info: Flask offers flask.sendfromdirectory() (https://flask.palletsprojects.com/en/3.0.x/api/#flask.sendfromdirectory) for such cases.

https://bugzilla.redhat.com/showbug.cgi?id=2279411