From 779cb1b7a2d7f53afe5fb6b372c614e7674a56d7 Mon Sep 17 00:00:00 2001
From: Zaid Abdulla <zaid@genieacs.com>
Date: Sun, 7 Jan 2018 00:12:18 -0800
Subject: [PATCH] Enforce session state

A fix for a security vulnerability reported by Maximilian Hils.
---
 lib/cwmp.coffee | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/lib/cwmp.coffee b/lib/cwmp.coffee
index ebdb632..5b7725f 100644
--- a/lib/cwmp.coffee
+++ b/lib/cwmp.coffee
@@ -895,7 +895,19 @@ listener = (httpRequest, httpResponse) ->
         stats.concurrentRequests -= 1
         return
 
-      return parsedRpc(sessionContext, rpc, parseWarnings) if sessionContext
+      if sessionContext
+        if rpc.cpeRequest?.name is 'Inform' or
+            (!sessionContext.rpcRequest ^ !(rpc.cpeResponse or rpc.cpeFault))
+          logger.accessError({
+            message: 'Bad session state'
+            sessionContext: sessionContext
+          })
+          httpResponse.writeHead(400, {'Connection': 'close'})
+          httpResponse.end('Bad session state')
+          stats.concurrentRequests -= 1
+          return
+
+        return parsedRpc(sessionContext, rpc, parseWarnings)
 
       if rpc.cpeRequest?.name isnt 'Inform'
         logger.accessError({