CVE-2016-4040: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.2
Published: 2016-04-19T14:59Z
Repository: https://github.com/dotCMS/core
Language: Java
Files changed: src/com/dotmarketing/cms/webforms/action/SubmitWebFormAction.java, src/com/dotmarketing/factories/EmailFactory.java, src/com/dotmarketing/portlets/workflows/model/WorkflowSearcher.java
Commit date: 2016-04-07 08:46:15 -0400
Commit message: fixes #8840 sort by sanitizing and email header injection

Diff: diff --git a/src/com/dotmarketing/cms/webforms/action/SubmitWebFormAction.java b/src/com/dotmarketing/cms/webforms/action/SubmitWebFormAction.java
index 9487a6041..4bae24606 100644
--- a/src/com/dotmarketing/cms/webforms/action/SubmitWebFormAction.java
+++ b/src/com/dotmarketing/cms/webforms/action/SubmitWebFormAction.java
@@ -107,10 +107,11 @@ public final class SubmitWebFormAction extends DispatchAction {
 				String queryString = request.getQueryString();
 				String invalidCaptchaURL = request.getParameter("invalidCaptchaReturnUrl");
 				if(!UtilMethods.isSet(invalidCaptchaURL)) {
 					invalidCaptchaURL = errorURL;
 				}
+				invalidCaptchaURL = invalidCaptchaURL.replaceAll("\\s", " ");
 				ActionForward af = new ActionForward();
 					af.setRedirect(true);
 					if (UtilMethods.isSet(queryString)) {
 						
 						af.setPath(invalidCaptchaURL + "?" + queryString + "&error=Validation-Image");
diff --git a/src/com/dotmarketing/factories/EmailFactory.java b/src/com/dotmarketing/factories/EmailFactory.java
index c18c2ba66..cb264e157 100644
--- a/src/com/dotmarketing/factories/EmailFactory.java
+++ b/src/com/dotmarketing/factories/EmailFactory.java
@@ -416,10 +416,27 @@ public class EmailFactory {
 				try { fromName = PublicEncryptionFactory.decryptString(fromName); } catch (Exception e) { }
 
 				String subject = (String)getMapValue("subject", parameters);
 				subject = (subject == null) ? "Mail from " + host.getHostname() + "" : subject;
 
+				
+				// strip line breaks from headers
+				from = from.replaceAll("\\s", " ");
+				to = to.replaceAll("\\s", " ");
+				cc = cc.replaceAll("\\s", " ");
+				bcc = bcc.replaceAll("\\s", " ");
+				fromName = fromName.replaceAll("\\s", " ");
+				subject = subject.replaceAll("\\s", " ");
+				
+				
+				
+				
+				
+				
+				
+				
+				
 				String emailFolder = (String)getMapValue("emailFolder", parameters);
 
 				boolean html = getMapValue("html", parameters) != null?Parameter.getBooleanFromString((String)getMapValue("html", parameters)):true;
 
 				String templatePath = (String) getMapValue("emailTemplate", parameters);
diff --git a/src/com/dotmarketing/portlets/workflows/model/WorkflowSearcher.java b/src/com/dotmarketing/portlets/workflows/model/WorkflowSearcher.java
index bc0503634..a56d3b6ea 100644
--- a/src/com/dotmarketing/portlets/workflows/model/WorkflowSearcher.java
+++ b/src/com/dotmarketing/portlets/workflows/model/WorkflowSearcher.java
@@ -3,10 +3,11 @@ package com.dotmarketing.portlets.workflows.model;
 import java.net.URLEncoder;
 import java.util.List;
 import java.util.Map;
 
 import com.dotmarketing.business.APILocator;
+import com.dotmarketing.common.util.SQLUtil;
 import com.dotmarketing.exception.DotDataException;
 import com.dotmarketing.util.UtilMethods;
 import com.liferay.portal.model.User;
 
 public class WorkflowSearcher {
@@ -98,10 +99,13 @@ public class WorkflowSearcher {
 		assignedTo = getStringValue("assignedTo", map);
 		createdBy = getStringValue("createdBy", map);
 		stepId = getStringValue("stepId", map);
 		keywords = getStringValue("keywords", map);
 		orderBy = getStringValue("orderBy", map);
+		
+		
+		orderBy= SQLUtil.sanitizeSortBy(orderBy);
 		show4all = getBooleanValue("show4all", map);
 		open = getBooleanValue("open", map);
 		closed = getBooleanValue("closed", map);
 		String daysOldstr = getStringValue("daysold", map);
 		
@@ -133,11 +137,11 @@ public class WorkflowSearcher {
 	public void setUser(User user) {
 		this.user = user;
 	}
 
 	public String getOrderBy() {
-		return orderBy;
+		return SQLUtil.sanitizeSortBy(orderBy);
 	}
 
 	public List<WorkflowTask> findTasks() throws DotDataException {
 
 		totalCount = APILocator.getWorkflowAPI().countTasks(this);
@@ -152,10 +156,11 @@ public class WorkflowSearcher {
 		return list;
 
 	}
 
 	public void setOrderBy(String orderBy) {
+		orderBy = SQLUtil.sanitizeSortBy(orderBy);
 		this.orderBy = orderBy;
 	}
 
 	public int getCount() {
 		return count;

Vulnerable code: 		return orderBy;
Fixed code: 				invalidCaptchaURL = invalidCaptchaURL.replaceAll("\\s", " ");
				
				// strip line breaks from headers
				from = from.replaceAll("\\s", " ");
				to = to.replaceAll("\\s", " ");
				cc = cc.replaceAll("\\s", " ");
				bcc = bcc.replaceAll("\\s", " ");
				fromName = fromName.replaceAll("\\s", " ");
				subject = subject.replaceAll("\\s", " ");
				
				
				
				
				
				
				
				
				
import com.dotmarketing.common.util.SQLUtil;
		
		
		orderBy= SQLUtil.sanitizeSortBy(orderBy);
		return SQLUtil.sanitizeSortBy(orderBy);
		orderBy = SQLUtil.sanitizeSortBy(orderBy);