Remote unauthenticated denial-of-service in Subversion mod_authz_svn. Summary: ======== Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. Known vulnerable: ================= mod_dav_svn+mod_authz_svn servers 1.9.0 through 1.10.6 (inclusive). mod_dav_svn+mod_authz_svn servers 1.11.0 through 1.14.0 (inclusive). Known fixed: ============ mod_dav_svn+mod_authz_svn servers 1.14.1 mod_dav_svn+mod_authz_svn servers 1.10.7 Details: ======== A null-pointer-dereference has been found in mod_authz_svn that results in a remote unauthenticated Denial-of-Service in some server configurations. The vulnerability can be triggered by an unauthenticated user if the Apache HTTPD server is configured to use an in-repository authz file, with configuration directives such as: AuthzSVNAccessFile "^/authz" AuthzSVNReposRelativeAccessFile "^/authz" The problem originates when sending a GET request to a non-existent repository. The mod_authz_svn module will attempt to find authz rules at a path within the requested SVN repository. Upon constructing this path, the function svn_repos_find_root_path will return a NULL pointer since the requested repository does not exist on-disk. A check for this legitimate NULL pointer condition is missing, which results in a segmentation fault when the NULL pointer is used. The in-repository authz feature was first introduced in Subversion 1.8: https://subversion.apache.org/docs/release-notes/1.8.html#in-repo-authz The missing NULL check was first introduced during refactoring of the authz code during development work leading up to Subversion 1.9. Subversion 1.8 servers are unaffected. Severity: ========= CVSSv3 Base Score: 7.5 (High) CVSSv3 Base Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Exploitation results in denial of service by crashing the HTTPD worker handling the request. The impact of this differs depending on how the Apache HTTPD server is configured, including the choice of MPM (Multi- Processing-Module). If the worker shares its memory address space with the main thread, as is the case with e.g. the Event MPM, the entire HTTPD server process will terminate. If the pre-fork MPM is used, the worker will terminate but the HTTPD server will stay up, and service availability will depend on how frequently the attacker is able to send malicious requests which target the vulnerability. Recommendations: ================ We recommend all users to upgrade to a known fixed release of the Subversion mod_dav_svn server. Users who are unable to upgrade may apply the included patches. As a workaround, the use of in-repository authz rules files with the AuthzSVNReposRelativeAccessFile can be avoided by switching to an alternative configuration which fetches an authz rules file from the server's filesystem, rather than from an SVN repository. References: =========== CVE-2020-17525 (Subversion) Reported by: ============ Thomas Ã…kesson, simonsoft.se Patches: ======== Patch for Subversion 1.10, 1.14: [[[ Index: subversion/libsvn_repos/config_file.c =================================================================== --- subversion/libsvn_repos/config_file.c (revision 1883994) +++ subversion/libsvn_repos/config_file.c (working copy) @@ -237,6 +237,10 @@ get_repos_config(svn_stream_t **stream, { /* Search for a repository in the full path. */ repos_root_dirent = svn_repos_find_root_path(dirent, scratch_pool); + if (repos_root_dirent == NULL) + return svn_error_trace(handle_missing_file(stream, checksum, access, + url, must_exist, + svn_node_none)); /* Attempt to open a repository at repos_root_dirent. */ SVN_ERR(svn_repos_open3(&access->repos, repos_root_dirent, NULL, ]]]