Title: Golang : Add Query To Detect PAM Authorization Bugs · Pull Request #709 · github/codeql-go · GitHub
Open Graph Title: Golang : Add Query To Detect PAM Authorization Bugs · Pull Request #709 · github/codeql-go
X Title: Golang : Add Query To Detect PAM Authorization Bugs · Pull Request #709 · github/codeql-go
Description: Using merely pam_authneticate call to grant access to a user can cause security issue. The pam_authenticate call only checks if the username and the password match. It does not check if the account is expired. Hence, a user with an expired login or an expired password can still login. This issue is fairly common and was recently found in gogs/gogs and go-gitea/gitea. In this case, the bugs were assigned CVE-2022-0871 and CVE-2022-0905 respectively. This PR aims to detect instances were an initiated PAM Transaction invokes the Authenticate method but does not invoke a call to the AcctMgmt method. Due to the nature of the query, I don't expect that may FP's or FN's. There could some unwanted alerts due to test code but to avoid that I filter out all file paths which have test in them. With this PR, I submit two queries, one using local data flow and the other using global taint flow. The global taint flow one should be more precise but may have a performance penalty while the other local flow one may lead to FN's but should be faster to execute. A quick run of both these queries on roughly 17 projects can be found in the LGTM runs below. global taint flow local data flow All of the results appear to be correct. The runs also includes two projects procupineyhairs/gogs_pam and porcupineyhairs/gitea_pam. These are vulnerable versions of the projects mentioned above. The alerts show a valid detection of the CVE. No alerts for the gogs and gitea projects shows detection of the patch correcting the bug. I am also working on two more PR's for C and Python respectively which detect the same underlying issue.
Open Graph Description: Using merely pam_authneticate call to grant access to a user can cause security issue. The pam_authenticate call only checks if the username and the password match. It does not check if the account...
X Description: Using merely pam_authneticate call to grant access to a user can cause security issue. The pam_authenticate call only checks if the username and the password match. It does not check if the account...
Opengraph URL: https://github.com/github/codeql-go/pull/709
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:2f477401-3f61-3c68-eba5-467596d4ad2d |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | CA70:A3B49:EC95DB:143DCB1:6A4D5E25 |
| html-safe-nonce | 1f09449b1203be4947d78b3645f13e23fd45b586aab52d01d9bb0201c529b228 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDQTcwOkEzQjQ5OkVDOTVEQjoxNDNEQ0IxOjZBNEQ1RTI1IiwidmlzaXRvcl9pZCI6Ijc2NTYwODI5NzI3NjA0MzIxNjUiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | 1e845d47abdfe5bf602af849505d9e042f34b00186e5262692ffb47ab1d30562 |
| hovercard-subject-tag | pull_request:892867005 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/github/codeql-go/pull/709/files |
| twitter:image | https://avatars.githubusercontent.com/u/10137?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/10137?s=400&v=4 |
| og:image:alt | Using merely pam_authneticate call to grant access to a user can cause security issue. The pam_authenticate call only checks if the username and the password match. It does not check if the account... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | e6658d7c7808aeed776f841e0839b885fce343c9b96244be612c779298e7661e |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/github/codeql-go git https://github.com/github/codeql-go.git |
| octolytics-dimension-user_id | 9919 |
| octolytics-dimension-user_login | github |
| octolytics-dimension-repository_id | 218150891 |
| octolytics-dimension-repository_nwo | github/codeql-go |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 218150891 |
| octolytics-dimension-repository_network_root_nwo | github/codeql-go |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | a438513d3a22ffcd713795ed948c3e5525007665 |
| ui-target | canary-2 |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width