Highlights
🔒 The host no longer trusts paths a device sends it
A paired device is not a trusted party. Until now, several commands built host filesystem paths straight from strings the device supplied: the file names a backup asks the host to read, write, move or delete, the members of a collected logarchive, the names listed by fetch-symbols, the sysdiagnose file name, a provisioning profile's own UUID, and the device identifier that names a pair record. A malicious or compromised device could point any of those outside the intended directory. All of them now go through one guard (pymobiledevice3.safe_paths) that refuses absolute paths, .., NULs, Windows device names, and anything that resolves outside its root; syslog collect extracts its archive member by member instead of extractall(); and recv_prefixed() caps a device-announced frame at 128 MiB. A refused path is reported as one line (DevicePathError) rather than a traceback.
Reported, with the fixes for the path issues, by @besendorf (GHSA-g7ph-v4p5-xwv3).
🔒 serve-web and serve-vnc listen on loopback, with an optional password
Both screen-mirroring servers used to bind 0.0.0.0 with nothing guarding touch, keyboard, buttons and clipboard. They now bind 127.0.0.1. Reaching them from the rest of the LAN is an explicit --bind 0.0.0.0, and --password protects every viewer: HTTP Basic for the web viewer (the browser asks once), real VNC authentication for the VNC server. The web viewer also refuses cross-origin requests, so a page in another tab cannot drive the device through it. Without a password the VNC server still accepts any entry in the client's password dialog, as macOS Screen Sharing requires — now documented rather than hidden.
pymobiledevice3 developer core-device display serve-web --bind 0.0.0.0 --password s3cret
pymobiledevice3 developer core-device display serve-vnc --bind 0.0.0.0 --password s3cretcryptography >= 43 is now required (VNC authentication uses DES from its decrepit module).
What's Changed
- c450fdb safe_paths: Refuse Windows device names in device-supplied paths (#1977) (@doronz88)
- 9626b4e core_device: Serve the screen on loopback by default, --password for the LAN (@doronz88)
- 0757db4 core_device: Put the serve-web viewer behind a password and an Origin check (@doronz88)
- bd8e7af core_device: Check the VNC password when serve-vnc is given one (@doronz88)
- c7a8c8c service_connection: Bound device-supplied frame lengths (@besendorf)
- 82b695c pairing: Constrain device identifiers used in record paths (@besendorf)
- bdf1abf provision: Validate profile UUIDs before writing files (@besendorf)
- e6f8ae8 core_device: Validate the sysdiagnose filename the device suggests (@besendorf)
- bc46e70 fetch_symbols: Keep downloads beneath the output root (@besendorf)
- b14acf9 os_trace: Extract a device archive without trusting its member names (@besendorf)
- 0d09356 mobilebackup2: Constrain device paths to the backup root (@besendorf)
- 14931bf safe_paths: Keep device-supplied names and paths beneath a host directory (@doronz88)
New Contributors
- @besendorf made their first contribution
Full Changelog: v11.16.3...v11.17.0