openerp-dev-web team mailing list archive

[Open Net Sàrl <openerp@xxxxxxxxxxx>]

So, NET-RPC is dangerous and Secure XML-RPC doesn't work (cf. bug #673775)...
What is left ???

-- 
You received this bug notification because you are a member of OpenERP
SA's Web Client R&D, which is a bug assignee.
https://bugs.launchpad.net/bugs/671926

Title:
  NET-RPC client-side stack should sanitize pickled data

Status in OpenERP GTK Client:
  Confirmed
Status in OpenERP GTK Client 5.0 series:
  Confirmed
Status in OpenERP Web Client:
  Confirmed
Status in OpenERP Web Client 5.0 series:
  Confirmed

Bug description:
  It's possible to execute arbritrary code on client using net-rpc
  (pickle protocol) see http://nadiana.com/python-pickle-insecure

  If you use the client to connect to some demo server and this demo
  server is malicious, it can send malicious code which is executed in
  client side.

  I attach a exploit server who sends code to execute to client. Run a
  ls -l and redirect the output to proof_of_exploit.txt file.

  This bug was fixed in the server, but not in the client.
  Affects versions 4.2, 5.X and 6.X