From dd54145d71d7b8d1092afc1821ca6a91764a0dff Mon Sep 17 00:00:00 2001 From: Aleksander Morgado Date: Mon, 29 Jun 2026 16:54:46 +0000 Subject: [PATCH] ussd: quote USSD command to prevent AT injection When sending an unencoded USSD command, the user-supplied string was spliced directly into the +CUSD AT command. If the string contained CR or semicolons, it could lead to AT command injection. Use mm_at_quote_string() to properly quote and escape the USSD command before sending it. https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1064 Signed-off-by: Aleksander Morgado --- src/mm-broadband-modem.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/mm-broadband-modem.c b/src/mm-broadband-modem.c index 9364a20b..b8d9c84e 100644 --- a/src/mm-broadband-modem.c +++ b/src/mm-broadband-modem.c @@ -6419,6 +6419,7 @@ modem_3gpp_ussd_context_send_unencoded (MMBroadbandModem *self) { Modem3gppUssdSendContext *ctx; gchar *at_command = NULL; + gchar *quoted_command; g_assert (self->priv->pending_ussd_action); ctx = g_task_get_task_data (self->priv->pending_ussd_action); @@ -6426,9 +6427,11 @@ modem_3gpp_ussd_context_send_unencoded (MMBroadbandModem *self) /* Build AT command with action unencoded */ ctx->unencoded_used = TRUE; ctx->current_is_unencoded = TRUE; - at_command = g_strdup_printf ("+CUSD=1,\"%s\",%d", - ctx->command, - MM_MODEM_GSM_USSD_SCHEME_7BIT); + quoted_command = mm_at_quote_string (ctx->command); + at_command = g_strdup_printf ("+CUSD=1,%s,%d", + quoted_command, + MM_MODEM_GSM_USSD_SCHEME_7BIT); + g_free (quoted_command); mm_base_modem_at_command (MM_BASE_MODEM (self), at_command,