Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-8707

Default basemodulepath should exclude /opt on Windows

    XMLWordPrintable

    Details

    • Template:
      PUP Bug Template
    • Epic Link:
    • Team:
      Coremunity
    • CVE-ID:
      CVE-2018-6513
    • Sprint:
      Platform Core KANBAN
    • Method Found:
      Needs Assessment
    • Release Notes:
      Security Fix
    • Release Notes Summary:
      Puppet on Windows no longer includes /opt/puppetlabs/puppet/modules in its default basemodulepath as unprivileged users could create a {{C:\opt}} directory and escalate privileges.
    • QA Risk Assessment:
      Needs Assessment

      Description

      On Windows, basemodulepath defaults to C:/ProgramData/PuppetLabs/code/modules;C:/opt/puppetlabs/puppet/modules when running as a privileged user. An unprivileged user can drop a custom ruby fact into C:/opt/puppetlabs/puppet/modules/<module>/lib/facter/<fact>.rb and escalate privileges the next time the puppet service runs. This is possible because Windows allows all users to create directories in C:/

      The basemodulepath should not include /opt on Windows.

        Attachments

          Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. PUP-4049 System module path should be a thing on Windows

          • Normal - Regular issue, some loss of functionality under specific circumstances.
          • Closed

            Activity

              People

              Assignee:
              Unassigned
              Reporter:
              josh Josh Cooper
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Zendesk Support