Forum


Notice to all users

We are migrating towards a new forum system located at community.teamspeak.com, as such this forum will become read-only on January 29, 2020

Results 1 to 4 of 4
  1. #1
    Join Date
    January 2013
    Posts
    31

    Guest can see QueryClients

    Good day, today I noticed that when you log on to the server, the server sends the client a list of all groups on the server (query groups, group templates)
    Click image for larger version. 

Name:	s-1535045320-b46b21c7-9f7e-4a2b-8a25-05acfe0560c1.png 
Views:	92 
Size:	8.0 KB 
ID:	17010
    Code:
    sgid=3 name=Server\sAdmin type=0 iconid=300 savedb=1 sortid=100002 namemode=0 n_modifyp=75 n_member_addp=75 n_member_removep=75
    sgid=4 name=Normal type=0 iconid=0 savedb=1 sortid=100003 namemode=0 n_modifyp=75 n_member_addp=60 n_member_removep=60
    sgid=5 name=Guest type=0 iconid=0 savedb=0 sortid=100004 namemode=0 n_modifyp=75 n_member_addp=0 n_member_removep=0
    there's nothing wrong with that, but still.

    Also...

    Guests see all actions query users without any permissions...
    Code:
    notifycliententerview cfid=0 ctid=1 reasonid=0 clid=21 client_unique_identifier=ServerQuery client_nickname=Unknown\sfrom\s108.61.78.149:54906 client_input_muted=0 client_output_muted=0 client_outputonly_muted=0 client_input_hardware=0 client_output_hardware=0 client_meta_data client_is_recording=0 client_database_id=100000 client_channel_group_id=8 client_servergroups=1,8 client_away=0 client_away_message client_type=1 client_flag_avatar client_talk_power=-1 client_talk_request=0 client_talk_request_msg client_description client_is_talker=0 client_is_priority_speaker=0 client_unread_messages=0 client_nickname_phonetic client_needed_serverquery_view_power=0 client_icon_id=0 client_is_channel_commander=0 client_country=US client_channel_group_inherited_channel_id=1 client_badges client_myteamspeak_id client_integrations
    
    notifyclientupdated clid=21 client_nickname=GameTracker
    
    notifyclientleftview cfid=1 ctid=0 reasonid=3 reasonmsg=connection\slost clid=21
    list permissions on user
    Code:
    b_channel_create_temporary                             1   0   0
    b_channel_create_with_password                         1   0   0
    b_channel_create_modify_with_codec_speex8              1   0   0
    b_channel_create_modify_with_codec_speex16             1   0   0
    b_channel_create_modify_with_codec_speex32             1   0   0
    b_channel_create_modify_with_codec_opusvoice           1   0   0
    i_channel_create_modify_with_codec_maxquality          10  0   0
    i_channel_create_modify_with_codec_latency_factor_min  1   0   0
    b_channel_create_with_maxclients                       1   0   0
    b_channel_create_with_needed_talk_power                1   0   0
    b_channel_create_modify_with_force_password            1   0   0
    i_channel_create_modify_with_temp_delete_delay         600 0   0
    b_channel_join_permanent                               1   0   0
    b_channel_join_semi_permanent                          1   0   0
    b_channel_join_temporary                               1   0   0
    i_channel_join_power                                   20  0   0
    i_channel_subscribe_power                              20  0   0
    i_channel_description_view_power                       20  0   0
    i_channel_max_depth                                    0   0   0
    i_group_needed_modify_power                            75  0   0
    i_icon_id                                              1016814685  0   0
    b_group_is_permanent                                   1   0   0
    i_group_sort_id                                        35  0   0
    i_client_needed_kick_from_server_power                 20  0   0
    i_client_needed_kick_from_channel_power                20  0   0
    i_client_needed_ban_power                              100 0   0
    i_client_needed_move_power                             20  0   0
    i_client_needed_private_textmessage_power              30  0   0
    b_client_channel_textmessage_send                      1   0   0
    i_client_talk_power                                    20  0   0
    i_client_needed_poke_power                             30  0   0
    i_client_needed_whisper_power                          100 0   0
    i_client_max_clones_uid                                0   0   0
    i_client_max_avatar_filesize                           200000  0   0
    i_client_max_channel_subscriptions                     -1  0   0
    b_client_request_talker                                1   0   0
    i_ft_file_download_power                               20  0   0
    i_ft_file_browse_power                                 20  0   0
    i_ft_quota_mb_download_per_client                      -1  0   0
    i_ft_quota_mb_upload_per_client                        -1  0   0

  2. #2
    Join Date
    June 2008
    Posts
    18,513
    I did moderate the thread because you wrote me it could be a vulnerability and i moved it into the permissions section because it looked like a permission issue (we only did see the half of your permissions. You did not show the permissions from Query group).

    Now i move this thread into the server section and leave the flag [Evaluation] on it. Maybe this will change soon or later.

    P.s. in your example the client itself could see the QueryClient in server tree. The Guest query has no i_client_needed_serverquery_view_power set on default permissions.

    ------------------------------------------------------

    We did check what is going on and following came out.

    Currently only the client GUI makes the ServerQuery Client invisible when permission i_client_needed_serverquery_view_power is to high. This is how it was build-in in the past.

    The QueryClient plugin uses the client API and the API does not restrict such things.
    A fix would be that client GUI stops doing this and the TS server restricts who can see the user.

    So we have 2 things here:
    1. The server does not hide a Query client from the client when i_client_needed_serverquery_view_power is to high.

    2. (your mentioned security risk)You can not rename a Query client before selecte a server and so everbody could see your IP in the Query nickname.
    We have a suggestion for this in our forum already but this did not made it into the server.
    https://forum.teamspeak.com/threads/134357
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

  3. #3
    Join Date
    January 2013
    Posts
    31
    you misunderstood me...
    server does not hide query clients from client always, i_client_needed_serverquery_view_power = 0

    Code:
    notifycliententerview cfid=0 ctid=1 reasonid=0 clid=1526 client_unique_identifier=ServerQuery client_nickname=Unknown\sfrom\s**************:58463 client_input_muted=0 client_output_muted=0 client_outputonly_muted=0 client_input_hardware=0 client_output_hardware=0 client_meta_data client_is_recording=0 client_database_id=705 client_channel_group_id=8 client_servergroups=1,8 client_away=0 client_away_message client_type=1 client_flag_avatar client_talk_power=1 client_talk_request=0 client_talk_request_msg client_description client_is_talker=0 client_is_priority_speaker=0 client_unread_messages=0 client_nickname_phonetic client_needed_serverquery_view_power=0 client_icon_id=0 client_is_channel_commander=0 client_country=US client_channel_group_inherited_channel_id=1 client_badges
    notifyclientupdated clid=1526 client_nickname=GameTracker
    notifycliententerview cfid=0 ctid=1 reasonid=0 clid=1527 client_unique_identifier=serveradmin client_nickname=serveradmin\sfrom\s**************:33540 client_input_muted=0 client_output_muted=0 client_outputonly_muted=0 client_input_hardware=0 client_output_hardware=0 client_meta_data client_is_recording=0 client_database_id=1 client_channel_group_id=8 client_servergroups=2 client_away=0 client_away_message client_type=1 client_flag_avatar client_talk_power=101 client_talk_request=0 client_talk_request_msg client_description client_is_talker=0 client_is_priority_speaker=0 client_unread_messages=0 client_nickname_phonetic client_needed_serverquery_view_power=100 client_icon_id=0 client_is_channel_commander=0 client_country=FR client_channel_group_inherited_channel_id=1 client_badges
    notifyclientupdated clid=1527 client_nickname=EterBanner
    when you connect to the server, it sends to the client: (regardless of the clients permissions)
    voice.teamspeak.com
    Code:
    notifyservergrouplist 
    sgid=1 name=Guest\sServer\sQuery type=2 iconid=0 savedb=0 sortid=0 namemode=0 n_modifyp=100 n_member_addp=0 n_member_removep=0
    sgid=2 name=Admin\sServer\sQuery type=2 iconid=500 savedb=1 sortid=0 namemode=0 n_modifyp=100 n_member_addp=100 n_member_removep=100
    sgid=3 name=Server\sAdmin type=0 iconid=300 savedb=1 sortid=0 namemode=0 n_modifyp=75 n_member_addp=75 n_member_removep=75
    sgid=4 name=Normal type=0 iconid=0 savedb=1 sortid=0 namemode=0 n_modifyp=75 n_member_addp=75 n_member_removep=75
    sgid=5 name=Guest type=0 iconid=0 savedb=0 sortid=0 namemode=0 n_modifyp=75 n_member_addp=0 n_member_removep=0
    sgid=116 name=TeamSpeak\sTeam type=1 iconid=300 savedb=1 sortid=1 namemode=0 n_modifyp=75 n_member_addp=75 n_member_removep=75
    sgid=118 name=Guest type=1 iconid=0 savedb=0 sortid=50 namemode=0 n_modifyp=75 n_member_addp=0 n_member_removep=0
    sgid=123 name=Guardian type=1 iconid=100 savedb=1 sortid=2 namemode=0 n_modifyp=74 n_member_addp=65 n_member_removep=65
    Click image for larger version. 

Name:	s-1535144968-436fabaf-03c4-4aa9-9b28-d4d4bcb80646.png 
Views:	30 
Size:	9.9 KB 
ID:	17020

  4. #4
    Join Date
    June 2008
    Posts
    18,513
    Quote Originally Posted by fyfywka View Post
    you misunderstood me...
    server does not hide query clients from client always, i_client_needed_serverquery_view_power = 0
    You repeated me. It's what i said.

    The server does not restrict that you can see a ServerQuery client or that you can see the group in the server group list.
    Only the client GUI hides the ServerQuery in the server tree when needed view power is to high.

    Your output is from client API and client API is not related to the client GUI in that case.
    When sending me private messages: Please make sure to include reference link to your forum thread or post.

    TeamSpeak FAQ || What should i report, when i open a client thread?

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Replies: 1
    Last Post: September 5th, 2016, 09:50 AM
  2. Replies: 2
    Last Post: February 8th, 2014, 05:36 PM
  3. Guest can kick Guest
    By setman590 in forum Permission System
    Replies: 1
    Last Post: March 24th, 2013, 02:21 PM
  4. Guest can kick and ban other Guest?
    By Shadowreaver in forum General Questions
    Replies: 15
    Last Post: January 23rd, 2011, 03:59 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •