View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0006667 | unreal | ircd | public | 2026-11-15 01:50 | 2026-11-15 01:50 |
| Reporter | gh0st | Assigned To | |||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | new | Resolution | open | ||
| Product Version | 6.2.7.1 | ||||
| Summary | 0006667: [pmlist 3rd-party module] CTCP auto-reply NOTICE adds the sender to the +P whitelist, bypassing +P | ||||
| Description | Third-party module: pmlist v2.1.2 by Gottem (third/pmlist). Filing here since there is no separate tracker category; please pass on to the module author. In pmlist_hook_cansend_user(), any PRIVMSG *or NOTICE* sent by a local +P user auto-adds the target to that user's whitelist. That includes the automatic NOTICE a client sends back in reply to a CTCP (VERSION, PING, TIME...). So anyone can CTCP a channel the +P user is in (or CTCP them directly, since CTCPs are a common exception), the victim's client auto-replies with a NOTICE, the attacker is now whitelisted, and can PM the +P user freely. This defeats the purpose of +P. | ||||
| Steps To Reproduce | 1. Load third/pmlist. User A sets umode +P (no whitelist entries). 2. User B sends a PRIVMSG to A: blocked, as expected. 3. User B sends a CTCP VERSION to a channel A is in. 4. A's client automatically replies with a NOTICE (\001VERSION ...\001) to B. 5. B is now on A's whitelist and can PM A. | ||||
| Additional Information | Suggested fix (tested): only auto-add on a real PRIVMSG that isn't a CTCP (CTCP ACTION excepted): if (MyUser(client) && HasPMList(client) && sendtype == SEND_TYPE_PRIVMSG && (**text != '\001' || !strncmp(*text, "\001ACTION", 7)) && !match_pmentry(client, to->id, to->name)) { Reported by gh0st ([email protected]). | ||||
| 3rd party modules | pmlist v2.1.2 (Gottem) | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-11-15 01:50 | gh0st | New Issue |
