Bug 13886 (CVE-2025-34311)

Created attachment 1673 [details]
Researcher Report

+++ This bug was initially created as a clone of Bug #13885 +++

I am a vulnerability analyst at VulnCheck responsible for managing our coordinated vulnerability disclosure (CVD) process. A researcher reported this vulnerability affecting IPFire, and VulnCheck is acting as the intermediary and coordinator.

We have tentatively reserved CVE-2025-34217, which have been shared with the researcher but will remain private until public disclosure:

Please be aware that none of this information is public at this moment and all participants are considered under embargo.

VulnCheck follows a 120-day disclosure policy, meaning we allow vendors/maintainers up to 120 days from the time of receiving the report to address the issues before publishing our advisory. For this vulnerability, that 120-day deadline falls on January 21, 2025.

---

When a user creates a Proxy report, an HTTP POST request is sent to the Request-URI "/cgi-bin/logs.cgi/calamaris.dat". When this request is received, the values of the parameters DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT are read and used in the following command (some parameters are optional, this is assuming all of the options are selected):

/var/ipfire/proxy/calamaris/bin/mkreport <DAY_BEGIN> <MONTH_BEGIN> <YEAR_BEGIN>
<DAY_END> <MONTH_END> <YEAR_END> -d <NUM_DOMAINS> -P <PERF_INTERVAL> -t <NUM_CONTENT> -D <HIST_LEVEL> -r <NUM_HOSTS> -R <NUM_URLS> -U <BYTE_UNIT>

where <DAY_BEGIN>, <MONTH_BEGIN>, <YEAR_BEGIN>, <DAY_END>, <MONTH_END>, <YEAR_END>, <NUM_DOMAINS>, <PERF_INTERVAL>, <NUM_CONTENT>, <HIST_LEVEL>, <NUM_HOSTS>, <NUM_URLS>, and <BYTE_UNIT> are equal to the values of the parameters DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT, respectively.

The values of the parameters DAY_BEGIN, MONTH_BEGIN, YEAR_BEGIN, DAY_END, MONTH_END, YEAR_END, NUM_DOMAINS, PERF_INTERVAL, NUM_CONTENT, HIST_LEVEL, NUM_HOSTS, NUM_URLS, and BYTE_UNIT are never sanitized for command injection-related characters. This can result in remote code execution in the
context of the user nobody.

---

The attachment contains additional technical details, the affected pathway, and proof of concept.