CVE-2017-14143: Use of Hard-coded Credentials (CWE-798)
value: The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 9.8
Published: 2017-09-19T15:29Z
Repository: https://github.com/kaltura/server
Language: PHP
Files changed: alpha/apps/kaltura/lib/kalturaAction.class.php, alpha/apps/kaltura/modules/system/actions/helperAction.class.php, plugins/admin_console/kaltura_internal_tools/admin/KalturaInternalToolsSystemHelperAction.php
Commit date: 2017-08-22 11:07:40 +0300
Commit message: remove unsafe unserialize

Diff: diff --git a/alpha/apps/kaltura/lib/kalturaAction.class.php b/alpha/apps/kaltura/lib/kalturaAction.class.php
index d9f0bfe6e7..faf8088b3f 100644
--- a/alpha/apps/kaltura/lib/kalturaAction.class.php
+++ b/alpha/apps/kaltura/lib/kalturaAction.class.php
@@ -451,25 +451,11 @@ abstract class kalturaAction extends sfAction
 		$this->setCredentialByName( $cred_name , $val );
 	}	
  
   protected function getUserzoneCookie() 
   {
-  	$cookie = $this->getContext()->getRequest()->getCookie('userzone');
-  	$length = strlen($cookie);
-  	if ($length <= 0)
-  		return null;
-  		
-  	$serialized_data = substr($cookie, 0, $length - 32);
-  	$hash_signiture = substr($cookie, $length - 32);
-  	  	 
-  	// check the signiture
-  	if (md5($serialized_data . $this->cookieSecret) != $hash_signiture)
-  		return null;
-  	
-  	$userzone_data = unserialize(base64_decode($serialized_data));
-  	
-  	return array($userzone_data['id'], $userzone_data['email'], $userzone_data['screenname']);
+  	return null;
   }
   
   protected function followRedirectCookie()
   {
 	$return_to = @$_COOKIE["kaltura_redirect"];
diff --git a/alpha/apps/kaltura/modules/system/actions/helperAction.class.php b/alpha/apps/kaltura/modules/system/actions/helperAction.class.php
index da0b083fd9..24b2d04463 100644
--- a/alpha/apps/kaltura/modules/system/actions/helperAction.class.php
+++ b/alpha/apps/kaltura/modules/system/actions/helperAction.class.php
@@ -26,11 +26,11 @@ class helperAction extends kalturaSystemAction
 		{
 			$res = str_replace ( array ( "|" , "/") , array ( "|01" , "|02" ) , base64_encode ( serialize ( $str ) ) ) ; 
 		}
 		elseif ( $algo == "wiki_decode" )
 		{
-			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
+			$res = null;
 		}
 		elseif ( $algo == "wiki_decode_no_serialize" )
 		{
 			$res = base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ;
 		}
diff --git a/plugins/admin_console/kaltura_internal_tools/admin/KalturaInternalToolsSystemHelperAction.php b/plugins/admin_console/kaltura_internal_tools/admin/KalturaInternalToolsSystemHelperAction.php
index c7ebd78842..77fa4ceec1 100644
--- a/plugins/admin_console/kaltura_internal_tools/admin/KalturaInternalToolsSystemHelperAction.php
+++ b/plugins/admin_console/kaltura_internal_tools/admin/KalturaInternalToolsSystemHelperAction.php
@@ -49,11 +49,11 @@ class KalturaInternalToolsPluginSystemHelperAction extends KalturaApplicationPlu
 		{
 			$res = str_replace ( array ( "|" , "/") , array ( "|01" , "|02" ) , base64_encode ( serialize ( $str ) ) ) ; 
 		}
 		elseif ( $algo == "wiki_decode" )
 		{
-			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
+			$res = null;
 		}
 		elseif ( $algo == "wiki_decode_no_serialize" )
 		{
 			$res = base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ;
 		}

Vulnerable code:   	$cookie = $this->getContext()->getRequest()->getCookie('userzone');
  	$length = strlen($cookie);
  	if ($length <= 0)
  		return null;
  		
  	$serialized_data = substr($cookie, 0, $length - 32);
  	$hash_signiture = substr($cookie, $length - 32);
  	  	 
  	// check the signiture
  	if (md5($serialized_data . $this->cookieSecret) != $hash_signiture)
  		return null;
  	
  	$userzone_data = unserialize(base64_decode($serialized_data));
  	
  	return array($userzone_data['id'], $userzone_data['email'], $userzone_data['screenname']);
			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
Fixed code:   	return null;
			$res = null;
			$res = null;