CVE-2021-41714: Download of Code Without Integrity Check (CWE-494)
value: In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage.
CWE description: The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
CVSS v3 base score: 6.5
Published: 2022-05-23T16:16Z
Repository: https://github.com/sdfsky/tipask
Language: PHP
Files changed: app/Http/Controllers/AttachController.php, app/Http/Controllers/ImageController.php
Commit date: 2021-09-17 11:10:54 +0800
Commit message: 文件下载漏洞修正

Diff: diff --git a/app/Http/Controllers/AttachController.php b/app/Http/Controllers/AttachController.php
index 62fb83b..75a6545 100755
--- a/app/Http/Controllers/AttachController.php
+++ b/app/Http/Controllers/AttachController.php
@@ -37,15 +37,16 @@ class AttachController extends Controller
         ]);
     }
 
 
     public function download($name){
-        $attachFile = storage_path('app/'.str_replace("-","/",$name));
+        $fileName = str_replace("..","",$name);
+        $attachFile = storage_path('app/'.str_replace("-","/",$fileName));
         if(!is_file($attachFile)){
             abort(404);
         }
         return response()->download($attachFile);
     }
 
 
 
-}
\ No newline at end of file
+}
diff --git a/app/Http/Controllers/ImageController.php b/app/Http/Controllers/ImageController.php
index 7b09e8c..62b89f7 100755
--- a/app/Http/Controllers/ImageController.php
+++ b/app/Http/Controllers/ImageController.php
@@ -18,11 +18,13 @@ class ImageController extends Controller
      * @param $avatar_name
      * @return mixed
      */
     public function avatar($avatar_name)
     {
-        list($user_id,$size) = explode('_',str_replace(".jpg",'',$avatar_name));
+        $fileName = str_replace("..","",$avatar_name);
+
+        list($user_id,$size) = explode('_',str_replace(".jpg",'',$fileName));
         $avatarFile = storage_path('app/'.User::getAvatarPath($user_id,$size));
         if(!is_file($avatarFile)){
             $avatarFile = public_path('static/images/default_avatar.jpg');
         }
         $image =   Image::make($avatarFile);
@@ -36,19 +38,21 @@ class ImageController extends Controller
 
 
 
     public function show($image_name)
     {
-        $imageFile = storage_path('app/'.str_replace("-","/",$image_name));
+        $fileName = str_replace("..","",$image_name);
+
+        $imageFile = storage_path('app/'.str_replace("-","/",$fileName));
         if(!is_file($imageFile)){
             abort(404);
         }
 
 
         $image =   Image::make($imageFile);
 
-        if(config('tipask.upload.open_watermark') && $image_name != config('tipask.upload.watermark_image') && str_contains($image_name,'attachments')){
+        if(config('tipask.upload.open_watermark') && $fileName != config('tipask.upload.watermark_image') && str_contains($fileName,'attachments')){
             $watermarkImage = storage_path('app/'.str_replace("-","/",config('tipask.upload.watermark_image')));
             $image->insert($watermarkImage, 'bottom-right', 15, 10);
         }
         $response = response()->make($image->encode('jpg'));
         $response->header('Content-Type', 'image/jpeg');

Vulnerable code:         $attachFile = storage_path('app/'.str_replace("-","/",$name));
}
        list($user_id,$size) = explode('_',str_replace(".jpg",'',$avatar_name));
        $imageFile = storage_path('app/'.str_replace("-","/",$image_name));
        if(config('tipask.upload.open_watermark') && $image_name != config('tipask.upload.watermark_image') && str_contains($image_name,'attachments')){
Fixed code:         $fileName = str_replace("..","",$name);
        $attachFile = storage_path('app/'.str_replace("-","/",$fileName));
}
        $fileName = str_replace("..","",$avatar_name);

        list($user_id,$size) = explode('_',str_replace(".jpg",'',$fileName));
        $fileName = str_replace("..","",$image_name);

        $imageFile = storage_path('app/'.str_replace("-","/",$fileName));
        if(config('tipask.upload.open_watermark') && $fileName != config('tipask.upload.watermark_image') && str_contains($fileName,'attachments')){