sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-13 00:49:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client] Treat a named upload URL as a request to upload in the privilege gate

Browse Source 
DebugBundle uploads when either the upload flag or the upload URL is set, but
the privilege gate was told only about the flag. With an MDM policy pinning the
destination the gate blanks the caller's URL, so a request carrying a URL and no
flag reached the empty-URL branch and found upload false: nothing to weaken, let
it through. The daemon then uploaded as root with TLS verification disabled on
behalf of an unprivileged caller.

A client older than the upload flag sends exactly that shape, a URL and nothing
else, so this needs no crafted request to reach.

The gate now derives the upload intent from the URL rather than trusting the
caller's flag, and DebugBundle computes it once so the gate and the local-only
early return cannot drift apart.
This commit is contained in:
riccardom
2026-10-09 09:57:31 +02:00
parent d5a9f5b0ff
commit 676181b908
3 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/server/debug_gate_test.go
+6
View File
@@ -133,6 +133,12 @@ func TestRequirePrivilegeForUploadURL(t *testing.T) {
{name: "custom URL ignored when MDM pins the destination", url: "https://attacker.example/upload-url", mdmPinned: true, unprivOK: true},
// Transport security is still the caller's to weaken, pinned or not.
{name: "insecure still gated when MDM pins the destination", url: "https://attacker.example/upload-url", insecure: true, mdmPinned: true, rootAlso: true},
// A named URL is itself a request to upload: DebugBundle uploads when
// either the flag or the URL is set. A client older than the upload flag
// sends exactly this shape, URL and no flag, and with MDM blanking the URL
// the gate must not read the missing flag as "no upload to weaken".
{name: "insecure, URL set, no upload flag, MDM pinned", url: "https://x.example/upload-url", insecure: true, noUpload: true, mdmPinned: true, rootAlso: true},
{name: "insecure, URL set, no upload flag", url: "https://x.example/upload-url", insecure: true, noUpload: true, rootAlso: true},
{name: "plaintext default host", url: "http://upload.debug.netbird.io/upload-url", invalid: true},
{name: "plaintext custom host", url: "http://attacker.example/upload-url", invalid: true},
{name: "unsupported scheme", url: "file:///etc/shadow", invalid: true},