CVE-2022-1032: Deserialization of Untrusted Data (CWE-502)
value: Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 7.2
Published: 2022-03-29T08:15Z
Repository: https://github.com/crater-invoice/crater
Language: PHP
Files changed: app/Http/Controllers/V1/Admin/Modules/UnzipModuleController.php, app/Http/Controllers/V1/Admin/Modules/UploadModuleController.php, app/Http/Requests/UnzipUpdateRequest.php, app/Http/Requests/UploadModuleRequest.php
Commit date: 2022-03-29 12:55:35 +0530
Commit message: Module upload validation (#857)

https://huntr.dev/bounties/cb9a0393-be34-4021-a06c-00c7791c7622/
Diff: diff --git a/app/Http/Controllers/V1/Admin/Modules/UnzipModuleController.php b/app/Http/Controllers/V1/Admin/Modules/UnzipModuleController.php
index a0b427c7..ddffd7ce 100644
--- a/app/Http/Controllers/V1/Admin/Modules/UnzipModuleController.php
+++ b/app/Http/Controllers/V1/Admin/Modules/UnzipModuleController.php
@@ -1,22 +1,22 @@
 <?php
 
 namespace Crater\Http\Controllers\V1\Admin\Modules;
 
 use Crater\Http\Controllers\Controller;
+use Crater\Http\Requests\UnzipUpdateRequest;
 use Crater\Space\ModuleInstaller;
-use Illuminate\Http\Request;
 
 class UnzipModuleController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @param  \Illuminate\Http\Request  $request
+     * @param  \Crater\Http\Requests\UnzipUpdateRequest  $request
      * @return \Illuminate\Http\Response
      */
-    public function __invoke(Request $request)
+    public function __invoke(UnzipUpdateRequest $request)
     {
         $this->authorize('manage modules');
 
         $path = ModuleInstaller::unzip($request->module, $request->path);
 
diff --git a/app/Http/Controllers/V1/Admin/Modules/UploadModuleController.php b/app/Http/Controllers/V1/Admin/Modules/UploadModuleController.php
index a700537f..34b10687 100644
--- a/app/Http/Controllers/V1/Admin/Modules/UploadModuleController.php
+++ b/app/Http/Controllers/V1/Admin/Modules/UploadModuleController.php
@@ -1,22 +1,22 @@
 <?php
 
 namespace Crater\Http\Controllers\V1\Admin\Modules;
 
 use Crater\Http\Controllers\Controller;
+use Crater\Http\Requests\UploadModuleRequest;
 use Crater\Space\ModuleInstaller;
-use Illuminate\Http\Request;
 
 class UploadModuleController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @param  \Illuminate\Http\Request  $request
+     * @param  \Crater\Http\Requests\UploadModuleRequest  $request
      * @return \Illuminate\Http\Response
      */
-    public function __invoke(Request $request)
+    public function __invoke(UploadModuleRequest $request)
     {
         $this->authorize('manage modules');
 
         $response = ModuleInstaller::upload($request);
 
diff --git a/app/Http/Requests/UnzipUpdateRequest.php b/app/Http/Requests/UnzipUpdateRequest.php
new file mode 100644
index 00000000..1557d6f3
--- /dev/null
+++ b/app/Http/Requests/UnzipUpdateRequest.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace Crater\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class UnzipUpdateRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     *
+     * @return bool
+     */
+    public function authorize()
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array
+     */
+    public function rules()
+    {
+        return [
+            'path' => [
+                'required',
+                'regex:/^[\.\/\w\-]+$/'
+            ],
+            'module' => [
+                'required',
+                'string'
+            ]
+        ];
+    }
+}
diff --git a/app/Http/Requests/UploadModuleRequest.php b/app/Http/Requests/UploadModuleRequest.php
new file mode 100644
index 00000000..da592941
--- /dev/null
+++ b/app/Http/Requests/UploadModuleRequest.php
@@ -0,0 +1,40 @@
+<?php
+
+namespace Crater\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class UploadModuleRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     *
+     * @return bool
+     */
+    public function authorize()
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array
+     */
+    public function rules()
+    {
+        return [
+            'avatar' => [
+                'required',
+                'file',
+                'mimes:zip',
+                'max:20000'
+            ],
+            'module' => [
+                'required',
+                'string',
+                'max:100'
+            ]
+        ];
+    }
+}

Vulnerable code: use Illuminate\Http\Request;
     * @param  \Illuminate\Http\Request  $request
    public function __invoke(Request $request)
use Illuminate\Http\Request;
     * @param  \Illuminate\Http\Request  $request
    public function __invoke(Request $request)
Fixed code: use Crater\Http\Requests\UnzipUpdateRequest;
     * @param  \Crater\Http\Requests\UnzipUpdateRequest  $request
    public function __invoke(UnzipUpdateRequest $request)
use Crater\Http\Requests\UploadModuleRequest;
     * @param  \Crater\Http\Requests\UploadModuleRequest  $request
    public function __invoke(UploadModuleRequest $request)
<?php

namespace Crater\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class UnzipUpdateRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'path' => [
                'required',
                'regex:/^[\.\/\w\-]+$/'
            ],
            'module' => [
                'required',
                'string'
            ]
        ];
    }
}
<?php

namespace Crater\Http\Requests;

use Illuminate\Foundation\Http\FormRequest;

class UploadModuleRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     *
     * @return bool
     */
    public function authorize()
    {
        return true;
    }

    /**
     * Get the validation rules that apply to the request.
     *
     * @return array
     */
    public function rules()
    {
        return [
            'avatar' => [
                'required',
                'file',
                'mimes:zip',
                'max:20000'
            ],
            'module' => [
                'required',
                'string',
                'max:100'
            ]
        ];
    }
}