CVE-2022-39297: Deserialization of Untrusted Data (CWE-502)
value: MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2022-10-12T23:15Z
Repository: https://github.com/melisplatform/melis-cms
Language: PHP
Files changed: src/Controller/FrontPluginsController.php, src/Controller/SitesConfigController.php, src/Controller/SitesController.php
Commit date: 2022-09-26 16:40:31 +0800
Commit message: added allowed_classes=false param to unserialize func

Diff: diff --git a/src/Controller/FrontPluginsController.php b/src/Controller/FrontPluginsController.php
index aa05201..e87c4c6 100644
--- a/src/Controller/FrontPluginsController.php
+++ b/src/Controller/FrontPluginsController.php
@@ -87,11 +87,11 @@ class FrontPluginsController extends MelisAbstractActionController
         $siteModule = (!empty($parameters['siteModule'])) ? $parameters['siteModule'] : '';
         $pluginHardcodedConfig = (!empty($parameters['pluginFrontConfig'])) ? $parameters['pluginFrontConfig'] : '';
 
         $pluginHardcodedConfig = html_entity_decode($pluginHardcodedConfig, ENT_QUOTES);
         $pluginHardcodedConfig = html_entity_decode($pluginHardcodedConfig, ENT_QUOTES);
-        $pluginHardcodedConfig = unserialize($pluginHardcodedConfig);
+        $pluginHardcodedConfig = unserialize($pluginHardcodedConfig, ['allowed_classes' => false]);  
 
         $errors = '';
         $tag = '';
         $tabs = array();
         $config = $this->getServiceManager()->get('config');
diff --git a/src/Controller/SitesConfigController.php b/src/Controller/SitesConfigController.php
index bbb4f82..1850835 100644
--- a/src/Controller/SitesConfigController.php
+++ b/src/Controller/SitesConfigController.php
@@ -139,18 +139,18 @@ class SitesConfigController extends MelisAbstractActionController
     {
         foreach ($dbConfigs as &$dbConfig) {
             if ($dbConfig['sconf_lang_id'] == '-1') {
                 $dbConfig['sconf_datas'] = [
                     'site' => [
-                        $siteName => unserialize($dbConfig['sconf_datas'])
+                        $siteName => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                     ],
                 ];
             } else {
                 $dbConfig['sconf_datas'] = [
                     'site' => [
                         $siteName => [
-                            $siteId => unserialize($dbConfig['sconf_datas'])
+                            $siteId => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                         ],
                     ],
                 ];
             }
         }
diff --git a/src/Controller/SitesController.php b/src/Controller/SitesController.php
index 815d6bd..5fd69cf 100644
--- a/src/Controller/SitesController.php
+++ b/src/Controller/SitesController.php
@@ -1535,18 +1535,18 @@ class SitesController extends MelisAbstractActionController
     {
         foreach ($dbConfigs as &$dbConfig) {
             if ($dbConfig['sconf_lang_id'] == '-1') {
                 $dbConfig['sconf_datas'] = [
                     'site' => [
-                        $siteName => unserialize($dbConfig['sconf_datas']),
+                        $siteName => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false]),
                     ],
                 ];
             } else {
                 $dbConfig['sconf_datas'] = [
                     'site' => [
                         $siteName => [
-                            $siteId => unserialize($dbConfig['sconf_datas'])
+                            $siteId => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                         ],
                     ],
                 ];
             }
         }

Vulnerable code:         $pluginHardcodedConfig = unserialize($pluginHardcodedConfig);
                        $siteName => unserialize($dbConfig['sconf_datas'])
                            $siteId => unserialize($dbConfig['sconf_datas'])
                        $siteName => unserialize($dbConfig['sconf_datas']),
                            $siteId => unserialize($dbConfig['sconf_datas'])
Fixed code:         $pluginHardcodedConfig = unserialize($pluginHardcodedConfig, ['allowed_classes' => false]);  
                        $siteName => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                            $siteId => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                        $siteName => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false]),
                            $siteId => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])