mirror of
https://github.com/github/codeql.git
synced 2026-07-20 18:58:36 +02:00
92033047a5
Using only a call to `pam_authenticate` to check the validity of a login can lead to authorization bypass vulnerabilities. A `pam_authenticate` only verifies the credentials of a user. It does not check if a user has an appropriate authorization to actually login. This means a user with a expired login or a password can still access the system. This PR includes a qhelp describing the issue, a query which detects instances where a call to `pam_acc_mgmt` does not follow a call to `pam_authenticate` and it's corresponding tests. This PR has multiple detections. Some of the public one I can find are : * [CVE-2022-0860](https://nvd.nist.gov/vuln/detail/CVE-2022-0860) found in [cobbler/cobbler](https://www.github.com/cobbler/cobbler) * [fredhutch/motuz](https://www.huntr.dev/bounties/d46f91ca-b8ef-4b67-a79a-2420c4c6d52b/)
17 lines
661 B
Python
17 lines
661 B
Python
def authenticate(self, username, password, service='login', encoding='utf-8', resetcreds=True):
|
|
libpam = CDLL(find_library("pam"))
|
|
pam_authenticate = libpam.pam_authenticate
|
|
pam_acct_mgmt = libpam.pam_acct_mgmt
|
|
pam_authenticate.restype = c_int
|
|
pam_authenticate.argtypes = [PamHandle, c_int]
|
|
pam_acct_mgmt.restype = c_int
|
|
pam_acct_mgmt.argtypes = [PamHandle, c_int]
|
|
|
|
handle = PamHandle()
|
|
conv = PamConv(my_conv, 0)
|
|
retval = pam_start(service, username, byref(conv), byref(handle))
|
|
|
|
retval = pam_authenticate(handle, 0)
|
|
if retval == 0:
|
|
retval = pam_acct_mgmt(handle, 0)
|
|
return retval == 0 |