Fix SQL injection, RCE via file deletion, and config injection#631
Open
7h30th3r0n3 wants to merge 1 commit into
Open
Fix SQL injection, RCE via file deletion, and config injection#6317h30th3r0n3 wants to merge 1 commit into
7h30th3r0n3 wants to merge 1 commit into
Conversation
…nerabilities
- play.php: Replace exec("sudo rm") with realpath() validation + unlink() to prevent
OS command injection via deletefile parameter (CVSSv3 9.8)
- play.php: Use parameterized query for filename lookup to prevent SQL injection
- common.php: Convert all 3 query functions (fetch_species_array, fetch_best_detection,
fetch_all_detections) from string interpolation to parameterized queries with bindValue()
- config.php: Sanitize all user-controlled values written to birdnet.conf using whitelist
patterns and numeric validation to prevent config injection leading to root RCE
- todays_detections.php: Replace 5 concatenated LIKE clauses with parameterized bindings
to prevent SQL injection via searchterm parameter
These fixes complement PR Nachtzuster#629 which addresses command injection in newname, shiftfile,
sendtest, and species_delete. Together they close all 7 identified vulnerabilities.
Ref: Nachtzuster#608
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes multiple critical security vulnerabilities in the BirdNET-Pi web interface. This PR complements #629 (which fixes command injection in
newname,shiftfile,sendtest, andspecies_delete) by addressing the remaining attack surfaces:deletefile(CVSSv3 9.8) —play.phppassed user input directly intoexec("sudo rm $file_pointer"). Replaced withrealpath()path validation + native PHPunlink().play.php—filenameparameter concatenated into query string. Now uses parameterizedbindValue().common.php(×3 functions) —fetch_species_array(),fetch_best_detection(), andfetch_all_detections()all interpolated user input into SQL. All converted to parameterized queries.todays_detections.php(×5 LIKE clauses) —searchtermparameter concatenated into 5 LIKE conditions. Now uses named parameter bindings:t1–:t5.config.php— Unsanitized user input written tobirdnet.conf(a bash-sourced file) allowed arbitrary command injection on next service restart. Added whitelist sanitization and numeric validation for all config values.Together with #629, this closes all 7 vulnerabilities reported in #608.
Files Changed
scripts/play.phpscripts/common.phpscripts/config.phpscripts/todays_detections.phpTest Plan
Ref: #608