WebDAV COPY/MOVE path overlap corrupts files and collections

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledsrc/http/modules/ngx_http_dav_module.c:559

   ngx_http_dav_copy_move_handler() (Destination header)

2. 1
   Step 01src/http/modules/ngx_http_dav_module.c:559-636

   The DAV COPY/MOVE handler takes the client-controlled Destination header, accepts either an absolute path or same-host absolute URI, and stores the parsed destination URI in duri.

   dest = r->headers_in.destination;
   
   if (dest == NULL) {
       ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                     "client sent no \"Destination\" header");
       return NGX_HTTP_BAD_REQUEST;
   }
   
   p = dest->value.data;
   /* there is always '\0' even after empty header value */
   if (p[0] == '/') {
       last = p + dest->value.len;
       goto destination_done;
   }
   
   /* ... same-host absolute URI validation ... */
   
   destination_done:
   
   duri.len = last - p;
   duri.data = p;
   flags = NGX_HTTP_LOG_UNSAFE;
   
   if (ngx_http_parse_unsafe_uri(r, &duri, &args, &flags) != NGX_OK) {
       goto invalid_destination;
   }
   

3. 2
   Step 02src/http/modules/ngx_http_dav_module.c:706-734 (before fix)

   The vulnerable handler maps both the request URI and Destination URI to filesystem paths, then proceeds without comparing whether path and copy.path are the same resource or a parent/child collection relationship.

   if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {
       return NGX_HTTP_INTERNAL_SERVER_ERROR;
   }
   
   uri = r->uri;
   r->uri = duri;
   
   if (ngx_http_map_uri_to_path(r, &copy.path, &root, 0) == NULL) {
       return NGX_HTTP_INTERNAL_SERVER_ERROR;
   }
   
   r->uri = uri;
   
   copy.path.len--;  /* omit "\0" */
   
   if (copy.path.data[copy.path.len - 1] == '/') {
       slash = 1;
       copy.path.len--;
       copy.path.data[copy.path.len] = '\0';
   
   } else {
       slash = 0;
   }
   
   ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                  "http copy to: \"%s\"", copy.path.data);
   

4. 3
   Step 03src/http/modules/ngx_http_dav_module.c:858-865 (before fix)

   For file COPY, the already-resolved source and destination paths flow directly into ngx_copy_file(). A request such as COPY /dav/file with Destination: /dav/file reaches this sink.

   cf.size = ngx_file_size(&fi);
   cf.buf_size = 0;
   cf.access = ngx_file_access(&fi);
   cf.time = ngx_file_mtime(&fi);
   cf.log = r->connection->log;
   
   if (ngx_copy_file(path.data, copy.path.data, &cf) == NGX_OK) {
       return NGX_HTTP_NO_CONTENT;
   }
   

5. 4
   Step 04src/core/ngx_file.c:811-848

   ngx_copy_file() opens the source first and later opens the destination with NGX_FILE_TRUNCATE. If both path strings identify the same file, the destination open truncates the file while the source descriptor still points to it.

   fd = ngx_open_file(from, NGX_FILE_RDONLY, NGX_FILE_OPEN, 0);
   
   /* ... size and access are derived from the source ... */
   
   nfd = ngx_open_file(to, NGX_FILE_WRONLY, NGX_FILE_TRUNCATE, access);
   
   if (nfd == NGX_INVALID_FILE) {
       ngx_log_error(NGX_LOG_CRIT, cf->log, ngx_errno,
                     ngx_open_file_n " \"%s\" failed", to);
       goto failed;
   }
   

6. 5
   Step 05src/http/modules/ngx_http_dav_module.c:806-829 (before fix)

   For collection COPY/MOVE, a destination inside the source tree can be created before ngx_walk_tree() recursively copies the source. For MOVE, the source tree is then deleted after a successful walk, compounding the corruption/destruction risk.

   if (ngx_create_dir(copy.path.data, ngx_file_access(&fi))
       == NGX_FILE_ERROR)
   {
       return ngx_http_dav_error(r->connection->log, ngx_errno,
                                 NGX_HTTP_NOT_FOUND,
                                 ngx_create_dir_n, copy.path.data);
   }
   
   copy.len = path.len;
   
   tree.file_handler = ngx_http_dav_copy_tree_file;
   tree.pre_tree_handler = ngx_http_dav_copy_dir;
   tree.post_tree_handler = ngx_http_dav_copy_dir_time;
   tree.spec_handler = ngx_http_dav_noop;
   tree.data = ©
   
   if (ngx_walk_tree(&tree, &path) == NGX_OK) {
   
       if (r->method == NGX_HTTP_MOVE) {
           rc = ngx_http_dav_delete_path(r, &path, 1);
   

7. 6
   Step 06src/http/modules/ngx_http_dav_module.c:725-745,885-940 (fix)

   Commit f0a0846 normalizes repeated slashes, then rejects same-path and parent-child collection operations before any filesystem mutation is attempted.

   ngx_http_dav_merge_slashes(&path);
   ngx_http_dav_merge_slashes(&copy.path);
   
   copy.path.len--;  /* omit "\0" */
   
   /* ... strip destination collection slash ... */
   
   if (ngx_http_dav_validate_paths(r, &path, &copy.path, slash, dest)
       != NGX_OK)
   {
       return NGX_HTTP_FORBIDDEN;
   }
   
   /* validation helper */
   if (len == dst->len && ngx_strncmp(src->data, dst->data, len) == 0) {
       return NGX_HTTP_FORBIDDEN;
   }
   
   if (slash
       && ngx_strncmp(src->data, dst->data, ngx_min(len, dst->len)) == 0
       && (len < dst->len
           ? dst->data[len] == '/'
           : src->data[dst->len] == '/'))
   {
       return NGX_HTTP_FORBIDDEN;
   }
   

8. Sinksrc/http/modules/ngx_http_dav_module.c:864

   ngx_copy_file() / 851:ngx_ext_rename_file() / 825:ngx_walk_tree()