Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-27601: Exposure of Resource to Wrong Sphere (CWE-668)
value: In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 3.5
Published: 2022-09-29T03:15Z
Repository: https://github.com/bigbluebutton/bigbluebutton
Language: JavaScript
Files changed: bigbluebutton-html5/imports/ui/components/chat/service.js
Commit date: 2020-04-28 13:24:44 +0000
Commit message: fix private chat lock not applying to already opened chats

Diff: diff --git a/bigbluebutton-html5/imports/ui/components/chat/service.js b/bigbluebutton-html5/imports/ui/components/chat/service.js
index db41aeabda..7beccbe229 100755
--- a/bigbluebutton-html5/imports/ui/components/chat/service.js
+++ b/bigbluebutton-html5/imports/ui/components/chat/service.js
@@ -131,13 +131,12 @@ const getPrivateGroupMessages = () => {
   return reduceAndMapGroupMessages(messages, []);
 };
 
 const isChatLocked = (receiverID) => {
   const isPublic = receiverID === PUBLIC_CHAT_ID;
-
   const meeting = Meetings.findOne({ meetingId: Auth.meetingID },
-    { fields: { 'lockSettingsProps.disablePublicChat': 1 } });
+    { fields: { 'lockSettingsProps.disablePublicChat': 1, 'lockSettingsProps.disablePrivateChat': 1 } });
   const user = Users.findOne({ meetingId: Auth.meetingID, userId: Auth.userID },
     { fields: { locked: 1, role: 1 } });
   const receiver = Users.findOne({ meetingId: Auth.meetingID, userId: receiverID },
     { fields: { role: 1 } });
   const isReceiverModerator = receiver && receiver.role === ROLE_MODERATOR;

Vulnerable code: 
    { fields: { 'lockSettingsProps.disablePublicChat': 1 } });
Fixed code:     { fields: { 'lockSettingsProps.disablePublicChat': 1, 'lockSettingsProps.disablePrivateChat': 1 } });
CVE-2020-27611: Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
value: BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.
CWE description: The product uses a broken or risky cryptographic algorithm or protocol.
CVSS v3 base score: 7.3
Published: 2020-10-21T15:15Z
Repository: https://github.com/bigbluebutton/bigbluebutton
Language: XML
Files changed: bigbluebutton-web/grails-app/conf/spring/turn-stun-servers.xml
Commit date: 2020-10-23 11:26:41 -0300
Commit message: Updating stun: for bbb-web to use Google's stun server

Diff: diff --git a/bigbluebutton-web/grails-app/conf/spring/turn-stun-servers.xml b/bigbluebutton-web/grails-app/conf/spring/turn-stun-servers.xml
index b36963d3c5..90913545e0 100755
--- a/bigbluebutton-web/grails-app/conf/spring/turn-stun-servers.xml
+++ b/bigbluebutton-web/grails-app/conf/spring/turn-stun-servers.xml
@@ -23,11 +23,11 @@ with BigBlueButton; if not, see <http://www.gnu.org/licenses/>.
     xsi:schemaLocation="http://www.springframework.org/schema/beans
             http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
             ">
 
     <bean id="stun1" class="org.bigbluebutton.web.services.turn.StunServer">
-        <constructor-arg index="0" value="stun:stun.freeswitch.org"/>
+        <constructor-arg index="0" value="stun:stun.l.google.com:19302"/>
     </bean>
 
     <!--bean id="stun2" class="org.bigbluebutton.web.services.turn.StunServer">
         <constructor-arg index="0" value="stun:stun2.example.com"/>
     </bean-->

Vulnerable code:         <constructor-arg index="0" value="stun:stun.freeswitch.org"/>
Fixed code:         <constructor-arg index="0" value="stun:stun.l.google.com:19302"/>
CVE-2020-28954: Improper Encoding or Escaping of Output (CWE-116)
value: web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 5.3
Published: 2020-11-19T22:15Z
Repository: https://github.com/bigbluebutton/bigbluebutton
Language: Other
Files changed: bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy
Commit date: 2020-11-13 05:59:31 +0000
Commit message: Sanitize fullName parameter of join API. Fixes #10818

Diff: diff --git a/bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy b/bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy
index 54803a19edb..38610fde2cd 100755
--- a/bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy
+++ b/bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy
@@ -243,10 +243,12 @@ class ApiController {
     }
 
     // Do we have a name for the user joining? If none, complain.
     if (!StringUtils.isEmpty(params.fullName)) {
       params.fullName = StringUtils.strip(params.fullName);
+      // remove control characters ( sanitize )
+      params.fullName = params.fullName.replaceAll("\\p{Cntrl}", "");
       if (StringUtils.isEmpty(params.fullName)) {
         errors.missingParamError("fullName");
       }
     } else {
       errors.missingParamError("fullName");

Fixed code:       // remove control characters ( sanitize )
      params.fullName = params.fullName.replaceAll("\\p{Cntrl}", "");
CVE-2021-4143: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-01-19T23:15Z
Repository: https://github.com/bigbluebutton/bigbluebutton
Language: Shell
Files changed: build/packages-template/bbb-etherpad/build.sh
Commit date: 2021-12-20 14:35:43 +0000
Commit message: build: use official ep_cursortrace

Diff: diff --git a/build/packages-template/bbb-etherpad/build.sh b/build/packages-template/bbb-etherpad/build.sh
index fb8e8cace55..5e207c9fae4 100755
--- a/build/packages-template/bbb-etherpad/build.sh
+++ b/build/packages-template/bbb-etherpad/build.sh
@@ -30,13 +30,11 @@ npm install ./ep_bigbluebutton_patches-*.tgz
 
 git clone https://github.com/mconf/ep_redis_publisher.git
 npm pack ./ep_redis_publisher
 npm install ./ep_redis_publisher-*.tgz
 
-# npm install ep_cursortrace
-# using mconf's fork due to https://github.com/ether/ep_cursortrace/pull/25 not being accepted upstream
-npm install git+https://github.com/mconf/ep_cursortrace.git
+npm install ep_cursortrace
 npm install ep_disable_chat
 
 # For some reason installing from github using npm 7.5.2 gives
 # fatal: could not create leading directories of '/root/.npm/_cacache/tmp/git-clone-76b94572': Permission denied
 #

Vulnerable code: # npm install ep_cursortrace
# using mconf's fork due to https://github.com/ether/ep_cursortrace/pull/25 not being accepted upstream
npm install git+https://github.com/mconf/ep_cursortrace.git
Fixed code: npm install ep_cursortrace
CVE-2023-33176: Server-Side Request Forgery (SSRF) (CWE-918)
value: BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery (SSRF) vulnerability. In an `insertDocument` API request the user is able to supply a URL from which the presentation should be downloaded. This URL was being used without having been successfully validated first. An update to the `followRedirect` method in the `PresentationUrlDownloadService` has been made to validate all URLs to be used for presentation download. Two new properties `presentationDownloadSupportedProtocols` and `presentationDownloadBlockedHosts` have also been added to `bigbluebutton.properties` to allow administrators to define what protocols a URL must use and to explicitly define hosts that a presentation cannot be downloaded from. All URLs passed to `insertDocument` must conform to the requirements of the two previously mentioned properties. Additionally, these URLs must resolve to valid addresses, and these addresses must not be local or loopback addresses. There are no workarounds. Users are advised to upgrade to a patched version of BigBlueButton.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 6.5
Published: 2023-06-26T20:15Z
Repository: https://github.com/bigbluebutton/bigbluebutton
Language: Unknown
Commit date: 2023-05-31 18:19:40 -0400
Commit message: Merge pull request #18045 from paultrudel/ssrf-fix

fix(sec): SSRF fix
CVE-2023-43797: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-10-30T23:15Z
Repository: https://github.com/bigbluebutton/bigbluebutton
Language: Unknown
Commit date: 2023-07-26 15:28:20 -0400
Commit message: Merge pull request from GHSA-v6wg-q866-h73x

fix(sec): Improve text sanitizing of lobby messages
CVE-2024-39302: Insufficient Information (NVD-CWE-noinfo)
value: BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the `/usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0` directory with the goal of privilege escalation, potentially exposing sensitive information on the server. This issue has been patched in version(s) 2.6.18, 2.7.8 and 3.0.0-alpha.7.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-28T21:15Z
Repository: https://github.com/bigbluebutton/bigbluebutton
Language: Shell
Files changed: build/packages-template/bbb-record-core/build.sh
Commit date: 2024-05-15 14:36:11 -0400
Commit message: build: set permissions for resque files [3.0]

Diff: diff --git a/build/packages-template/bbb-record-core/build.sh b/build/packages-template/bbb-record-core/build.sh
index b8c19fea30c..8329290a83d 100755
--- a/build/packages-template/bbb-record-core/build.sh
+++ b/build/packages-template/bbb-record-core/build.sh
@@ -32,10 +32,12 @@ pushd staging/usr/local/bigbluebutton/core
   bundle install
   # Remove unneeded files to reduce package size
   bundle clean
   rm -r vendor/bundle/ruby/*/cache
   find vendor/bundle -name '*.o' -delete
+  find vendor/bundle/ruby/*/gems/resque-*/lib/resque/server/public -type f -name "*.png" -execdir chmod 0644 {} \;
+  find vendor/bundle/ruby/*/gems/resque-*/bin -type f -execdir chmod 0755 {} \;
 popd
 
 cp Rakefile  staging/usr/local/bigbluebutton/core
 cp bbb-record-core.logrotate staging/etc/logrotate.d
 

Fixed code:   find vendor/bundle/ruby/*/gems/resque-*/lib/resque/server/public -type f -name "*.png" -execdir chmod 0644 {} \;
  find vendor/bundle/ruby/*/gems/resque-*/bin -type f -execdir chmod 0755 {} \;
CVE-2024-28185: Insufficient Information (NVD-CWE-noinfo)
value: Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When executing a submission, Judge0 writes a `run_script` to the sandbox directory. The security issue is that an attacker can create a symbolic link (symlink) at the path `run_script` before this code is executed, resulting in the `f.write` writing to an arbitrary file on the unsandboxed system. An attacker can leverage this vulnerability to overwrite scripts on the system and gain code execution outside of the sandbox.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-18T15:15Z
Repository: https://github.com/judge0/judge0
Language: Other
Files changed: Dockerfile
Commit date: 2024-03-06 13:37:25 +0100
Commit message: Use user judge0

Diff: diff --git a/Dockerfile b/Dockerfile
index 59fe592..5c47c57 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -36,24 +36,18 @@ RUN cat /etc/cron.d/* | crontab -
 COPY . .
 
 ENTRYPOINT ["/api/docker-entrypoint.sh"]
 CMD ["/api/scripts/server"]
 
+RUN useradd -u 1000 -m -r judge0 && \
+    echo "judge0 ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers && \
+    chown -R judge0: /api
+
+USER judge0
+
 ENV JUDGE0_VERSION "1.13.0"
 LABEL version=$JUDGE0_VERSION
 
 
 FROM production AS development
 
-ARG DEV_USER=judge0
-ARG DEV_USER_ID=1000
-
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        tmux \
-        vim && \
-    useradd -u $DEV_USER_ID -m -r $DEV_USER && \
-    echo "$DEV_USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers
-
-USER $DEV_USER
-
 CMD ["sleep", "infinity"]

Vulnerable code: ARG DEV_USER=judge0
ARG DEV_USER_ID=1000

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        tmux \
        vim && \
    useradd -u $DEV_USER_ID -m -r $DEV_USER && \
    echo "$DEV_USER ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers

USER $DEV_USER

Fixed code: RUN useradd -u 1000 -m -r judge0 && \
    echo "judge0 ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers && \
    chown -R judge0: /api

USER judge0
CVE-2021-4169: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-26T12:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php, lhc_web/modules/lhuser/avatarbuilder.php
Commit date: 2021-12-25 14:54:15 -0500
Commit message: Proper escape

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php b/lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php
index b7081fe946..513fcc52f7 100644
--- a/lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhchat/avatarbuilder.tpl.php
@@ -61,11 +61,11 @@
                                 </div>
                             </div>
                     <?php endforeach; ?>
                 </div>
                 <div class="col-6">
-                    <img width="w-100" id="id_avatar_img" src='<?php echo erLhcoreClassDesign::baseurl('widgetrestapi/avatar')?>/<?php echo htmlspecialchars($id)?>' alt="" title="" />
+                    <img width="w-100" id="id_avatar_img" src='<?php echo erLhcoreClassDesign::baseurl('widgetrestapi/avatar')?>/<?php echo urlencode(htmlspecialchars($id))?>' alt="" title="" />
                 </div>
             </div>
 
             <div class="row">
                 <div class="col-12">
diff --git a/lhc_web/modules/lhuser/avatarbuilder.php b/lhc_web/modules/lhuser/avatarbuilder.php
index 4c5b139020..d20d1f6a33 100644
--- a/lhc_web/modules/lhuser/avatarbuilder.php
+++ b/lhc_web/modules/lhuser/avatarbuilder.php
@@ -1,9 +1,9 @@
 <?php
 $tpl = erLhcoreClassTemplate::getInstance('lhchat/avatarbuilder.tpl.php');
 
-$id = $Params['user_parameters']['id'];
+$id = strip_tags($Params['user_parameters']['id']);
 
 $prefix = isset($_GET['prefix']) ? strip_tags($_GET['prefix']) : '';
 
 if (empty($id)) {
     $id = erLhcoreClassModelForgotPassword::randomPassword();

Vulnerable code:                     <img width="w-100" id="id_avatar_img" src='<?php echo erLhcoreClassDesign::baseurl('widgetrestapi/avatar')?>/<?php echo htmlspecialchars($id)?>' alt="" title="" />
$id = $Params['user_parameters']['id'];
Fixed code:                     <img width="w-100" id="id_avatar_img" src='<?php echo erLhcoreClassDesign::baseurl('widgetrestapi/avatar')?>/<?php echo urlencode(htmlspecialchars($id))?>' alt="" title="" />
$id = strip_tags($Params['user_parameters']['id']);
CVE-2021-4175: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-12-29T15:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhmobile/settings.tpl.php
Commit date: 2021-12-27 00:38:31 -0500
Commit message: Missing htmlspecialchars

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhmobile/settings.tpl.php b/lhc_web/design/defaulttheme/tpl/lhmobile/settings.tpl.php
index f6952f6461..61161e8fe6 100644
--- a/lhc_web/design/defaulttheme/tpl/lhmobile/settings.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhmobile/settings.tpl.php
@@ -12,11 +12,11 @@
         <label><input type="checkbox" value="on" name="notifications" <?php isset($mb_options['notifications']) && ($mb_options['notifications'] == true) ? print 'checked="checked"' : ''?> /> Enable notifications</label><br/>
     </div>
 
     <div class="form-group">
         <label>FCM Key</label>
-        <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print $mb_options['fcm_key'] : ''?>" />
+        <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print htmlspecialchars($mb_options['fcm_key']) : ''?>" />
     </div>
 
     <input type="submit" class="btn btn-secondary" name="StoreOptions" value="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/buttons','Save'); ?>" />
 
 </form>

Vulnerable code:         <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print $mb_options['fcm_key'] : ''?>" />
Fixed code:         <input type="text" class="form-control" name="fcm_key" value="<?php isset($mb_options['fcm_key']) ? print htmlspecialchars($mb_options['fcm_key']) : ''?>" />
CVE-2021-4176: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-29T15:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/pagelayouts/widget.php
Commit date: 2021-12-27 00:47:39 -0500
Commit message: Old widget postMessage escape string

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/pagelayouts/widget.php b/lhc_web/design/defaulttheme/tpl/pagelayouts/widget.php
index 4f4ac70ce7..62ac1ffb21 100644
--- a/lhc_web/design/defaulttheme/tpl/pagelayouts/widget.php
+++ b/lhc_web/design/defaulttheme/tpl/pagelayouts/widget.php
@@ -62,15 +62,15 @@ if (!!window.postMessage) {
 	<?php if (isset($Result['chat']) && is_numeric($Result['chat']->id)) : ?>
 	parent.postMessage("lhc_ch:hash:<?php echo $Result['chat']->id,'_',$Result['chat']->hash?>", '*');
 	parent.postMessage("lhc_ch:hash_resume:<?php echo $Result['chat']->id,'_',$Result['chat']->hash?>", '*');
 	<?php endif; ?>
 	<?php if (isset($Result['additional_post_message'])) : ?>
-	parent.postMessage("<?php echo $Result['additional_post_message']?>", '*');
+	parent.postMessage(<?php echo json_encode($Result['additional_post_message'])?>, '*');
 	<?php endif;?>
 	<?php if (isset($Result['parent_messages'])) : 
 	foreach ($Result['parent_messages'] as $msgPArent) : ?>
-	parent.postMessage("<?php echo $msgPArent?>", '*');
+	parent.postMessage(<?php echo json_encode($msgPArent)?>, '*');
 	<?php endforeach;endif;?>
 
     function handleCrossMessage(e) {
         if (typeof e.data !== 'string') { return; }
         var action = e.data.split(':')[0];

Vulnerable code: 	parent.postMessage("<?php echo $Result['additional_post_message']?>", '*');
	parent.postMessage("<?php echo $msgPArent?>", '*');
Fixed code: 	parent.postMessage(<?php echo json_encode($Result['additional_post_message'])?>, '*');
	parent.postMessage(<?php echo json_encode($msgPArent)?>, '*');
CVE-2022-0083: Generation of Error Message Containing Sensitive Information (CWE-209)
value: livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 5.3
Published: 2022-01-04T07:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhuser/forgotpasswordsent.tpl.php, lhc_web/modules/lhuser/forgotpassword.php
Commit date: 2022-01-03 01:11:45 -0500
Commit message: Show same message in all cases

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhuser/forgotpasswordsent.tpl.php b/lhc_web/design/defaulttheme/tpl/lhuser/forgotpasswordsent.tpl.php
index abf505a04bf..08edc0849ff 100644
--- a/lhc_web/design/defaulttheme/tpl/lhuser/forgotpasswordsent.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhuser/forgotpasswordsent.tpl.php
@@ -1,2 +1,2 @@
 <h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/forgotpasswordsent','Password reminder');?></h1>
-<p><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/forgotpasswordsent','E-mail sent. Click the link in the email and You will be able to set a new password.')?></p>
+<p><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/forgotpasswordsent','If this e-mail exists we have send password remind link. Click the link in the email and You will be able to set a new password.')?></p>
diff --git a/lhc_web/modules/lhuser/forgotpassword.php b/lhc_web/modules/lhuser/forgotpassword.php
index 093e5f5b02a..c487cb3a701 100644
--- a/lhc_web/modules/lhuser/forgotpassword.php
+++ b/lhc_web/modules/lhuser/forgotpassword.php
@@ -92,13 +92,13 @@ if (isset($_POST['Forgotpassword'])) {
 			$mail->ClearAddresses();
 
 			$tpl = erLhcoreClassTemplate::getInstance( 'lhuser/forgotpasswordsent.tpl.php');
 
 		} else {
-			erLhcoreClassModule::redirect('user/forgotpassword');
-			exit;
+            $tpl = erLhcoreClassTemplate::getInstance( 'lhuser/forgotpasswordsent.tpl.php');
 		}
+
     }  else {
         $tpl->set('errors',$Errors);
     }
 }
 

Vulnerable code: <p><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/forgotpasswordsent','E-mail sent. Click the link in the email and You will be able to set a new password.')?></p>
			erLhcoreClassModule::redirect('user/forgotpassword');
			exit;
Fixed code: <p><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/forgotpasswordsent','If this e-mail exists we have send password remind link. Click the link in the email and You will be able to set a new password.')?></p>
            $tpl = erLhcoreClassTemplate::getInstance( 'lhuser/forgotpasswordsent.tpl.php');
CVE-2022-0226: Cross-Site Request Forgery (CSRF) (CWE-352)
value: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2022-01-14T19:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/modules/lhaudit/configuration.php
Commit date: 2022-01-13 14:04:29 -0500
Commit message: Missing csfr check

Diff: diff --git a/lhc_web/modules/lhaudit/configuration.php b/lhc_web/modules/lhaudit/configuration.php
index d90131d3667..a4b68ce03fc 100644
--- a/lhc_web/modules/lhaudit/configuration.php
+++ b/lhc_web/modules/lhaudit/configuration.php
@@ -5,10 +5,15 @@ $tpl = erLhcoreClassTemplate::getInstance('lhaudit/configuration.tpl.php');
 $auditOptions = erLhcoreClassModelChatConfig::fetch('audit_configuration');
 $data = (array)$auditOptions->data;
 
 if ( isset($_POST['StoreOptions']) ) {
 
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect();
+        exit;
+    }
+    
     $definition = array(
         'days_log' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'int'),
         'log_js' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'boolean'),
         'log_user' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'boolean'),
         'log_block' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'boolean'),

Fixed code:     if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect();
        exit;
    }
CVE-2022-0231: Cross-Site Request Forgery (CSRF) (CWE-352)
value: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2022-01-14T12:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhfile/configuration.tpl.php, lhc_web/modules/lhfile/configuration.php
Commit date: 2022-01-14 06:45:58 -0500
Commit message: CSRF for file configuration URL

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhfile/configuration.tpl.php b/lhc_web/design/defaulttheme/tpl/lhfile/configuration.tpl.php
index 868e51c7493..2bc4ec8c222 100644
--- a/lhc_web/design/defaulttheme/tpl/lhfile/configuration.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhfile/configuration.tpl.php
@@ -8,10 +8,12 @@
 	<?php include(erLhcoreClassDesign::designtpl('lhkernel/alert_success.tpl.php'));?>
 <?php endif; ?>
 
 <form action="" ng-non-bindable method="post">
 
+    <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>
+
     <div class="row">
         <div class="col-6">
             <div class="form-group">
                 <label><input type="checkbox" name="ActiveFileUploadUser" value="on" <?php isset($file_data['active_user_upload']) && ($file_data['active_user_upload'] == true) ? print 'checked="checked"' : '' ?> /><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Files upload for users is active'); ?></label>
             </div>
diff --git a/lhc_web/modules/lhfile/configuration.php b/lhc_web/modules/lhfile/configuration.php
index e8e3663feaf..08244dcc590 100644
--- a/lhc_web/modules/lhfile/configuration.php
+++ b/lhc_web/modules/lhfile/configuration.php
@@ -5,10 +5,16 @@ $tpl = erLhcoreClassTemplate::getInstance('lhfile/configuration.tpl.php');
 $fileData = erLhcoreClassModelChatConfig::fetch('file_configuration');
 $data = (array)$fileData->data;
 
 
 if (isset($_POST['StoreFileConfiguration'])) {
+
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect('file/configuration');
+        exit;
+    }
+
     $definition = array(
         'AllowedFileTypes' => new ezcInputFormDefinitionElement(
             ezcInputFormDefinitionElement::OPTIONAL, 'string'
         ),
         'AllowedFileTypesUser' => new ezcInputFormDefinitionElement(

Fixed code:     <?php include(erLhcoreClassDesign::designtpl('lhkernel/csfr_token.tpl.php'));?>


    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
        erLhcoreClassModule::redirect('file/configuration');
        exit;
    }
CVE-2022-0266: Authorization Bypass Through User-Controlled Key (CWE-639)
value: Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 6.6
Published: 2022-01-19T06:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/modules/lhuser/delete.php, lhc_web/modules/lhuser/deletegroup.php
Commit date: 2022-01-18 00:18:36 -0500
Commit message: Display logic should match backand logic

Diff: diff --git a/lhc_web/modules/lhuser/delete.php b/lhc_web/modules/lhuser/delete.php
index 7b27317987d..a18203b0f2b 100644
--- a/lhc_web/modules/lhuser/delete.php
+++ b/lhc_web/modules/lhuser/delete.php
@@ -8,10 +8,15 @@ if (!$currentUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'
 if ($currentUser->getUserID() == $Params['user_parameters']['user_id']) {
     die('You can not delete your own account!');
     exit;
 }
 
+if ((int)$Params['user_parameters']['user_id'] == 1) {
+    die('admin account never can be deleted!');
+    exit;
+}
+
 $departament = erLhcoreClassUser::getSession()->load( 'erLhcoreClassModelUser', $Params['user_parameters']['user_id']);
 erLhcoreClassUser::getSession()->delete($departament);
 
 // Transfered chats to user
 $q = ezcDbInstance::get()->createDeleteQuery();
diff --git a/lhc_web/modules/lhuser/deletegroup.php b/lhc_web/modules/lhuser/deletegroup.php
index 447bd98b3de..184ce825b81 100644
--- a/lhc_web/modules/lhuser/deletegroup.php
+++ b/lhc_web/modules/lhuser/deletegroup.php
@@ -3,10 +3,15 @@
 if (!$currentUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'])) {
 	die('Invalid CSFR Token');
 	exit;
 }
 
+if ((int)$Params['user_parameters']['group_id'] == 1) {
+    die('admin account never can be deleted!');
+    exit;
+}
+
 erLhcoreClassGroup::deleteGroup((int)$Params['user_parameters']['group_id']);
 
 erLhcoreClassAdminChatValidatorHelper::clearUsersCache();
 
 erLhcoreClassModule::redirect('user/grouplist');

Fixed code: if ((int)$Params['user_parameters']['user_id'] == 1) {
    die('admin account never can be deleted!');
    exit;
}

if ((int)$Params['user_parameters']['group_id'] == 1) {
    die('admin account never can be deleted!');
    exit;
}
CVE-2022-0395: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-28T22:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
Commit date: 2022-01-27 15:08:18 -0500
Commit message: Escape in user box

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php b/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
index 9e5ea86a27e..2c1b42a5213 100644
--- a/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
@@ -10,11 +10,11 @@ if ($UserData->force_logout == 1) {
     $currentUser->logout();
 }
 
 ?>
 <li class="nav-item dropleft">
-    <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false"><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>
+    <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false" ng-non-bindable><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>
     <div class="dropdown-menu" style="min-width: 25rem;" role="menu">
 
         <div class="row">
             <div class="col-6">
                 <div class="pl-2 pt-1 font-weight-bold" ng-non-bindable>

Vulnerable code:     <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false"><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>
Fixed code:     <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false" ng-non-bindable><?php echo htmlspecialchars($UserData->name),' ',htmlspecialchars($UserData->surname)?></a>
CVE-2022-1213: Server-Side Request Forgery (SSRF) (CWE-918)
value: SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 8.1
Published: 2022-04-05T04:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/modules/lhcobrowse/proxycss.php
Commit date: 2022-04-03 15:37:19 -0400
Commit message: fix #1752

Diff: diff --git a/lhc_web/modules/lhcobrowse/proxycss.php b/lhc_web/modules/lhcobrowse/proxycss.php
index 7838aa53fdf..89097ca00cb 100644
--- a/lhc_web/modules/lhcobrowse/proxycss.php
+++ b/lhc_web/modules/lhcobrowse/proxycss.php
@@ -13,11 +13,17 @@ if ($Params['user_parameters_unordered']['cobrowsemode'] == 'onlineuser'){
 } else {
     $chat = erLhcoreClassChat::getSession()->load('erLhcoreClassModelChat', $Params['user_parameters']['chat_id']);
     $browse = erLhcoreClassCoBrowse::getBrowseInstance($chat);
 }
 
-$url = parse_url($_GET['base']);
+$base = trim($_GET['base']);
+
+if (!filter_var($base, FILTER_VALIDATE_URL)) {
+    exit;
+}
+
+$url = parse_url($base);
 
 // Only http/https supported
 if (!in_array($url['scheme'],['http','https']) || (isset($url['port']) && !in_array($url['port'],[80,443]))) {
     exit;
 }
@@ -40,11 +46,11 @@ if (isset($url['host']) && $url['host'] != '' && strpos($_GET['css'], $_SERVER['
         } else {
             $urlCSSDownload = $url['scheme'] . '://' . $url['host'] . '/' . ltrim($_GET['css'], '/');
         }
     } else {
 
-        if (!in_array($urlCSS['scheme'],['http','https']) || (isset($urlCSS['port']) && !in_array($urlCSS['port'],[80,443]))) {
+        if (!filter_var($_GET['css'], FILTER_VALIDATE_URL) || !in_array($urlCSS['scheme'],['http','https']) || (isset($urlCSS['port']) && !in_array($urlCSS['port'],[80,443]))) {
             exit;
         }
 
         $urlCSSDownload = $_GET['css'];
     }

Vulnerable code: $url = parse_url($_GET['base']);
        if (!in_array($urlCSS['scheme'],['http','https']) || (isset($urlCSS['port']) && !in_array($urlCSS['port'],[80,443]))) {
Fixed code: $base = trim($_GET['base']);

if (!filter_var($base, FILTER_VALIDATE_URL)) {
    exit;
}

$url = parse_url($base);
        if (!filter_var($_GET['css'], FILTER_VALIDATE_URL) || !in_array($urlCSS['scheme'],['http','https']) || (isset($urlCSS['port']) && !in_array($urlCSS['port'],[80,443]))) {
CVE-2023-26103: Inefficient Regular Expression Complexity (CWE-1333)
value: Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-02-25T05:15Z
Repository: https://github.com/denoland/deno
Language: JavaScript
Files changed: ext/http/01_http.js
Commit date: 2023-02-10 19:41:20 +0000
Commit message: refactor(ext/http): use `String.prototype.trim()` instead of regex (#17722)


Diff: diff --git a/ext/http/01_http.js b/ext/http/01_http.js
index 6807ad973..1da371e8d 100644
--- a/ext/http/01_http.js
+++ b/ext/http/01_http.js
@@ -49,10 +49,11 @@ const {
   SetPrototypeAdd,
   SetPrototypeDelete,
   StringPrototypeIncludes,
   StringPrototypeToLowerCase,
   StringPrototypeSplit,
+  StringPrototypeTrim,
   Symbol,
   SymbolAsyncIterator,
   TypeError,
   Uint8Array,
   Uint8ArrayPrototype,
@@ -391,24 +392,26 @@ const _ws = Symbol("[[associated_ws]]");
 
 function upgradeWebSocket(request, options = {}) {
   const upgrade = request.headers.get("upgrade");
   const upgradeHasWebSocketOption = upgrade !== null &&
     ArrayPrototypeSome(
-      StringPrototypeSplit(upgrade, /\s*,\s*/),
-      (option) => StringPrototypeToLowerCase(option) === "websocket",
+      StringPrototypeSplit(upgrade, ","),
+      (option) =>
+        StringPrototypeToLowerCase(StringPrototypeTrim(option)) === "websocket",
     );
   if (!upgradeHasWebSocketOption) {
     throw new TypeError(
       "Invalid Header: 'upgrade' header must contain 'websocket'",
     );
   }
 
   const connection = request.headers.get("connection");
   const connectionHasUpgradeOption = connection !== null &&
     ArrayPrototypeSome(
-      StringPrototypeSplit(connection, /\s*,\s*/),
-      (option) => StringPrototypeToLowerCase(option) === "upgrade",
+      StringPrototypeSplit(connection, ","),
+      (option) =>
+        StringPrototypeToLowerCase(StringPrototypeTrim(option)) === "upgrade",
     );
   if (!connectionHasUpgradeOption) {
     throw new TypeError(
       "Invalid Header: 'connection' header must contain 'Upgrade'",
     );

Vulnerable code:       StringPrototypeSplit(upgrade, /\s*,\s*/),
      (option) => StringPrototypeToLowerCase(option) === "websocket",
      StringPrototypeSplit(connection, /\s*,\s*/),
      (option) => StringPrototypeToLowerCase(option) === "upgrade",
Fixed code:   StringPrototypeTrim,
      StringPrototypeSplit(upgrade, ","),
      (option) =>
        StringPrototypeToLowerCase(StringPrototypeTrim(option)) === "websocket",
      StringPrototypeSplit(connection, ","),
      (option) =>
        StringPrototypeToLowerCase(StringPrototypeTrim(option)) === "upgrade",
CVE-2017-1002150: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2017-09-14T13:29Z
Repository: https://github.com/fedora-infra/python-fedora
Language: Python
Files changed: fedora/tg/utils.py
Commit date: 2017-05-05 19:17:07 +0200
Commit message: Disable covert redirects and CSRF token leaking

This disallows the url() function from returning any remote URLs.
This prevents covert redirects, and also prevents us from leaking
CSRF tokens to outside parties.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

Diff: diff --git a/fedora/tg/utils.py b/fedora/tg/utils.py
index 4f18f31..9913df7 100644
--- a/fedora/tg/utils.py
+++ b/fedora/tg/utils.py
@@ -79,10 +79,15 @@ def url(tgpath, tgparams=None, **kwargs):
     .. versionadded:: 0.3.10
        Modified from turbogears.controllers.url for :ref:`CSRF-Protection`
     '''
     if not isinstance(tgpath, six.string_types):
         tgpath = '/'.join(list(tgpath))
+    if not tgpath.startswith('/'):
+        # Do not allow the url() function to be used for external urls.
+        # This function is primarily used in redirect() calls, so this prevents
+        # covert redirects and thus CSRF leaking.
+        tgpath = '/'
     if tgpath.startswith('/'):
         webpath = (config.get('server.webpath') or '').rstrip('/')
         if tg_util.request_available():
             check_app_root()
             tgpath = request.app_root + tgpath

Fixed code:     if not tgpath.startswith('/'):
        # Do not allow the url() function to be used for external urls.
        # This function is primarily used in redirect() calls, so this prevents
        # covert redirects and thus CSRF leaking.
        tgpath = '/'
CVE-2022-4087: Observable Discrepancy (CWE-203)
value: A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through discrepancy. The name of the patch is 186306d6199096b7a7c4b4574d4be8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulnerability.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 4.3
Published: 2022-11-21T07:15Z
Repository: https://github.com/ipxe/ipxe
Language: C
Files changed: src/net/tls.c
Commit date: 2022-11-08 15:14:06 +0000
Commit message: [tls] Treat invalid block padding as zero length padding

Harden against padding oracle attacks by treating invalid block
padding as zero length padding, thereby deferring the failure until
after computing the (incorrect) MAC.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

Diff: diff --git a/src/net/tls.c b/src/net/tls.c
index fdaa2190..8a3ac3ee 100644
--- a/src/net/tls.c
+++ b/src/net/tls.c
@@ -2819,12 +2819,12 @@ static int tls_new_ciphertext ( struct tls_connection *tls,
 
 	/* Strip block padding, if applicable */
 	if ( is_block_cipher ( cipher ) ) {
 		pad_len = tls_verify_padding ( tls, last );
 		if ( pad_len < 0 ) {
-			rc = pad_len;
-			return rc;
+			/* Assume zero padding length to avoid timing attacks */
+			pad_len = 0;
 		}
 		iob_unput ( last, pad_len );
 		len -= pad_len;
 	}
 

Vulnerable code: 			rc = pad_len;
			return rc;
Fixed code: 			/* Assume zero padding length to avoid timing attacks */
			pad_len = 0;
CVE-2020-36569: Improper Authentication (CWE-287)
value: Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.1
Published: 2022-12-27T22:15Z
Repository: https://github.com/nanobox-io/golang-nanoauth
Language: Unknown
Commit date: 2020-01-31 08:10:40 -0500
Commit message: Merge pull request #5 from bouk/constant-time-compare

Small security fixes
CVE-2015-4425: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2015-08-18T17:59Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: pimcore/modules/admin/controllers/AssetController.php
Commit date: 2015-04-20 07:54:08 +0000
Commit message: AssetController: directory traversal vulnerability issue

git-svn-id: http://www.pimcore.org/svn/pimcore/private/core/trunk@6458 1f8fe7d8-47f0-464c-8d0a-336f4953ab05

Diff: diff --git a/pimcore/modules/admin/controllers/AssetController.php b/pimcore/modules/admin/controllers/AssetController.php
index fec5d5ba7..e897b8d3f 100644
--- a/pimcore/modules/admin/controllers/AssetController.php
+++ b/pimcore/modules/admin/controllers/AssetController.php
@@ -208,10 +208,17 @@ class Admin_AssetController extends \Pimcore\Controller\Action\Admin\Element
             // this is for uploading folders with Drag&Drop
             // param "dir" contains the relative path of the file
             $parent = Asset::getById($this->getParam("parentId"));
             $newPath = $parent->getFullPath() . "/" . trim($this->getParam("dir"), "/ ");
 
+            // check if the path is outside of the asset directory
+            $newRealPath = PIMCORE_ASSET_DIRECTORY . $newPath;
+            $newRealPath= realpath($newRealPath);
+            if (strpos($newRealPath, PIMCORE_ASSET_DIRECTORY) !== 0) {
+                throw new Exception("not allowed");
+            }
+
             $maxRetries = 5;
             for ($retries=0; $retries<$maxRetries; $retries++) {
                 try {
                     $newParent = Asset\Service::createFolderByPath($newPath);
                     break;

Fixed code:             // check if the path is outside of the asset directory
            $newRealPath = PIMCORE_ASSET_DIRECTORY . $newPath;
            $newRealPath= realpath($newRealPath);
            if (strpos($newRealPath, PIMCORE_ASSET_DIRECTORY) !== 0) {
                throw new Exception("not allowed");
            }