View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0006668 | unreal | ircd | public | 2026-11-15 01:51 | 2026-11-15 01:51 |
| Reporter | gh0st | Assigned To | |||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | new | Resolution | open | ||
| Product Version | 6.2.7.1 | ||||
| Summary | 0006668: [pmlist 3rd-party module] -persist whitelist entries match any logged-in user with that nick, allowing takeover | ||||
| Description | Third-party module: pmlist v2.1.2 by Gottem (third/pmlist). Filing here since there is no separate tracker category; please pass on to the module author. In match_pmentry(), a persistent entry (OPENPM <nick> -persist) matches any user who is logged in to services (any account) and whose nick matches the stored nick. When it matches, the stored UID is rewritten to the new user's UID, so the entry now belongs to them. So another user, logged into a *different* account, can simply switch to the whitelisted nick (e.g. while the real owner is offline), PM the +P user, and keep the whitelist entry even after changing nick back. | ||||
| Steps To Reproduce | 1. User A sets +P and runs OPENPM Friend -persist. 2. Friend (account 'friend') disconnects. 3. User C, logged in to services as account 'other', changes nick to Friend. 4. C can now PM A, and A's persistent entry now points to C's UID. 5. C changes nick to anything else and can still PM A. | ||||
| Additional Information | Suggested fix (tested): store the services account name in the entry at OPENPM time and require acptr->user->account to match it (not just 'is logged in') before matching or rewriting the UID of a persistent entry. Reported by gh0st ([email protected]). | ||||
| 3rd party modules | pmlist v2.1.2 (Gottem) | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-11-15 01:51 | gh0st | New Issue |
