Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-17670: Server-Side Request Forgery (SSRF) (CWE-918)
value: WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 9.8
Published: 2019-10-17T13:15Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/pluggable.php, wp-includes/version.php
Commit date: 2019-10-14 10:52:04 +0000
Commit message: Formatting: In `wp_validate_redirect()`, normalize the path when validating the location for relative URLs, to account for Windows paths.

Props peterwilsoncc, rconde, jmmathc, mat-lipe, Sixes, justinahinon, cmagrin, daxelrod, SergeyBiryukov.
Fixes #47980.
Built from https://develop.svn.wordpress.org/trunk@46472


git-svn-id: http://core.svn.wordpress.org/trunk@46270 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/pluggable.php b/wp-includes/pluggable.php
index 468e0655866..206761aaef9 100644
--- a/wp-includes/pluggable.php
+++ b/wp-includes/pluggable.php
@@ -1416,10 +1416,11 @@ if ( ! function_exists( 'wp_validate_redirect' ) ) :
 
 		if ( ! isset( $lp['host'] ) && ! empty( $lp['path'] ) && '/' !== $lp['path'][0] ) {
 			$path = '';
 			if ( ! empty( $_SERVER['REQUEST_URI'] ) ) {
 				$path = dirname( parse_url( 'http://placeholder' . $_SERVER['REQUEST_URI'], PHP_URL_PATH ) . '?' );
+				$path = wp_normalize_path( $path );
 			}
 			$location = '/' . ltrim( $path . '/', '/' ) . $location;
 		}
 
 		// Reject if certain components are set but host is not. This catches urls like https:host.com for which parse_url does not set the host field.
diff --git a/wp-includes/version.php b/wp-includes/version.php
index f08acb103a4..39b23db8c1d 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -11,11 +11,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.3-beta3-46471';
+$wp_version = '5.3-beta3-46472';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '5.3-beta3-46471';
Fixed code: 				$path = wp_normalize_path( $path );
$wp_version = '5.3-beta3-46472';
CVE-2019-17673: Insufficient Information (NVD-CWE-noinfo)
value: WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2019-10-17T13:15Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-includes/rest-api.php, wp-includes/version.php
Commit date: 2019-10-14 15:43:04 +0000
Commit message: REST API: Send a Vary: Origin header on GET requests.

Add this header on all GET requests to prevent cached requests.

Props darthhexx, davidbinda, nickdaugherty, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46478


git-svn-id: http://core.svn.wordpress.org/trunk@46276 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-includes/rest-api.php b/wp-includes/rest-api.php
index 3e6f419f6b3..b998cf7cda4 100644
--- a/wp-includes/rest-api.php
+++ b/wp-includes/rest-api.php
@@ -587,10 +587,12 @@ function rest_send_cors_headers( $value ) {
 		}
 		header( 'Access-Control-Allow-Origin: ' . $origin );
 		header( 'Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, PATCH, DELETE' );
 		header( 'Access-Control-Allow-Credentials: true' );
 		header( 'Vary: Origin' );
+	} else if ( 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
+		header( 'Vary: Origin' );
 	}
 
 	return $value;
 }
 
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 76be1c0883c..838d9192f9e 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -11,11 +11,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '5.3-beta3-46477';
+$wp_version = '5.3-beta3-46478';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: $wp_version = '5.3-beta3-46477';
Fixed code: 	} else if ( 'GET' === $_SERVER['REQUEST_METHOD'] && ! is_user_logged_in() ) {
		header( 'Vary: Origin' );
$wp_version = '5.3-beta3-46478';
CVE-2020-15259: Cross-Site Request Forgery (CSRF) (CWE-352)
value: ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions <=5.0.12. If you do not have ad-ldap-connector admin console enabled or do not visit any other public URL while on the machine it is installed on, you are not affected. The issue is fixed in version 5.0.13.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2020-11-06T20:15Z
Repository: https://github.com/auth0/ad-ldap-connector
Language: Unknown
Commit date: 2020-11-05 12:06:11 -0800
Commit message: Merge pull request from GHSA-vx5q-cp9v-427v

add CSRF protection in admin api's
CVE-2015-10030: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file src/Sukohi/Surpass/Surpass.php. The manipulation of the argument dir leads to pathname traversal. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as d22337d453a2a14194cdb02bf12cdf9d9f827aa7. It is recommended to upgrade the affected component. VDB-217642 is the identifier assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2023-01-08T10:15Z
Repository: https://github.com/SUKOHI/Surpass
Language: PHP
Files changed: README.md, src/Sukohi/Surpass/Surpass.php
Commit date: 2015-04-09 03:13:28 +0900
Commit message: Some code added to protect from directory traversal attack.

Diff: diff --git a/README.md b/README.md
index 41e75ac..8458095 100644
--- a/README.md
+++ b/README.md
@@ -83,10 +83,13 @@ Usage
 	return View::make('surpass', [
 			
 		'surpass' => $surpass
 			
 	]);
+	
+	
+*Note: method dir('dir_name') can no longer receive "/" and "." to protect from directory traversal attack.
 
 **Upload  (in View)**
 
     (in View)    
     
diff --git a/src/Sukohi/Surpass/Surpass.php b/src/Sukohi/Surpass/Surpass.php
index dd15462..02f1792 100644
--- a/src/Sukohi/Surpass/Surpass.php
+++ b/src/Sukohi/Surpass/Surpass.php
@@ -48,11 +48,11 @@ class Surpass {
 
     }
 
     public function dir($dir) {
 
-        $this->_dir = $dir;
+        $this->_dir = str_replace(["\0", '/', '.'], '', $dir);
         $this->_id_hidden_name = self::ID_HIDDEN_NAME .'_'. $dir;
         return $this;
 
     }
 

Vulnerable code:         $this->_dir = $dir;
Fixed code: 	
	
*Note: method dir('dir_name') can no longer receive "/" and "." to protect from directory traversal attack.
        $this->_dir = str_replace(["\0", '/', '.'], '', $dir);
CVE-2016-1709: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 8.8
Published: 2016-07-23T19:59Z
Repository: https://github.com/googlei18n/sfntly
Language: Unknown
Commit date: 2016-06-10 15:47:52 -0700
Commit message: Merge pull request #56 from leizleiz/bytearray

Add a bounds check to ByteArray::Get().
CVE-2016-1709: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 8.8
Published: 2016-07-23T19:59Z
Repository: https://github.com/googlei18n/sfntly
Language: C++
Files changed: cpp/src/sfntly/data/byte_array.cc
Commit date: 2016-06-09 23:30:26 -0700
Commit message: Add a bounds check to ByteArray::Get().

Diff: diff --git a/cpp/src/sfntly/data/byte_array.cc b/cpp/src/sfntly/data/byte_array.cc
index 915a40c..57f9eed 100644
--- a/cpp/src/sfntly/data/byte_array.cc
+++ b/cpp/src/sfntly/data/byte_array.cc
@@ -33,10 +33,12 @@ int32_t ByteArray::SetFilledLength(int32_t filled_length) {
   filled_length_ = std::min<int32_t>(filled_length, storage_length_);
   return filled_length_;
 }
 
 int32_t ByteArray::Get(int32_t index) {
+  if (index < 0 || index >= Length())
+    return -1;
   return InternalGet(index) & 0xff;
 }
 
 int32_t ByteArray::Get(int32_t index, ByteVector* b) {
   assert(b);

Fixed code:   if (index < 0 || index >= Length())
    return -1;
CVE-2015-5460: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in app/views/events/_menu.html.erb in Snorby 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the title (cls.name variable) when creating a classification.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-07-08T16:59Z
Repository: https://github.com/Snorby/snorby
Language: Ruby
Files changed: app/views/events/_menu.html.erb
Commit date: 2015-07-01 08:23:16 -0400
Commit message: Fixed xss issue

Diff: diff --git a/app/views/events/_menu.html.erb b/app/views/events/_menu.html.erb
index e12a137..9494e5f 100644
--- a/app/views/events/_menu.html.erb
+++ b/app/views/events/_menu.html.erb
@@ -1,12 +1,12 @@
 <%= drop_down_for('Classify Event(s)', 'icons/actions.png', 'incident') do %>
 	
 	<% @classifications.each do |cls| %>
 		<% if cls.locked && cls.hotkey %>
-			<%= drop_down_item "#{cls.name}<span class='shortcut'>#{cls.shortcut}</span>", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
+			<%= drop_down_item "#{sanitize cls.name}<span class='shortcut'>#{cls.shortcut}</span>", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
 		<% else %>
-			<%= drop_down_item "#{cls.name}", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
+			<%= drop_down_item "#{sanitize cls.name}", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
 		<% end %>
 	<% end %>
 	
 	<%= drop_down_item "Unclassified<span class='shortcut'>ctrl+shift+u</span>", '#', nil, { :class => 'classification', :"data-classification-id" => 0 } %>
 	

Vulnerable code: 			<%= drop_down_item "#{cls.name}<span class='shortcut'>#{cls.shortcut}</span>", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
			<%= drop_down_item "#{cls.name}", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
Fixed code: 			<%= drop_down_item "#{sanitize cls.name}<span class='shortcut'>#{cls.shortcut}</span>", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
			<%= drop_down_item "#{sanitize cls.name}", '#', nil, { :class => 'classification', :"data-classification-id" => cls.id.to_i } %>
CVE-2009-1194: Numeric Errors (CWE-189)
value: Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
Published: 2009-05-11T15:30Z
Repository: https://github.com/bratsche/pango
Language: C
Files changed: pango/glyphstring.c
Commit date: 2009-03-02 12:00:52 +0330
Commit message: [glyphstring] Handle overflow with very long glyphstrings

Diff: diff --git a/pango/glyphstring.c b/pango/glyphstring.c
index 42601d52..8fb70313 100644
--- a/pango/glyphstring.c
+++ b/pango/glyphstring.c
@@ -59,18 +59,32 @@ pango_glyph_string_set_size (PangoGlyphString *string, gint new_len)
   g_return_if_fail (new_len >= 0);
 
   while (new_len > string->space)
     {
       if (string->space == 0)
-	string->space = 1;
+	{
+	  string->space = 4;
+	}
       else
-	string->space *= 2;
-
-      if (string->space < 0)
 	{
-	  g_warning ("glyph string length overflows maximum integer size, truncated");
-	  new_len = string->space = G_MAXINT - 8;
+	  const guint max_space =
+	    MIN (G_MAXINT, G_MAXSIZE / MAX (sizeof(PangoGlyphInfo), sizeof(gint)));
+
+	  guint more_space = (guint)string->space * 2;
+
+	  if (more_space > max_space)
+	    {
+	      more_space = max_space;
+
+	      if ((guint)new_len > max_space)
+		{
+		  g_error ("%s: failed to allocate glyph string of length %i\n",
+			   G_STRLOC, new_len);
+		}
+	    }
+
+	  string->space = more_space;
 	}
     }
 
   string->glyphs = g_realloc (string->glyphs, string->space * sizeof (PangoGlyphInfo));
   string->log_clusters = g_realloc (string->log_clusters, string->space * sizeof (gint));

Vulnerable code: 	string->space = 1;
	string->space *= 2;

      if (string->space < 0)
	  g_warning ("glyph string length overflows maximum integer size, truncated");
	  new_len = string->space = G_MAXINT - 8;
Fixed code: 	{
	  string->space = 4;
	}
	  const guint max_space =
	    MIN (G_MAXINT, G_MAXSIZE / MAX (sizeof(PangoGlyphInfo), sizeof(gint)));

	  guint more_space = (guint)string->space * 2;

	  if (more_space > max_space)
	    {
	      more_space = max_space;

	      if ((guint)new_len > max_space)
		{
		  g_error ("%s: failed to allocate glyph string of length %i\n",
			   G_STRLOC, new_len);
		}
	    }

	  string->space = more_space;
CVE-2011-3602: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name.  NOTE: this can be leveraged with a symlink to overwrite arbitrary files.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2014-04-27T21:55Z
Repository: https://github.com/reubenhwk/radvd
Language: C
Files changed: device-linux.c
Commit date: 2011-10-04 00:33:15 -0700
Commit message: set_interface_var() doesn't check interface name and blindly does
fopen(path "/" ifname, "w") on it.  As "ifname" is an untrusted input, it
should be checked for ".." and/or "/" in it.  Otherwise, an infected
unprivileged daemon may overwrite contents of file named "mtu",
"hoplimit", etc. in arbitrary location with arbitrary 32-bit value in
decimal representation ("%d").  If an attacker has a local account or
may create arbitrary symlinks with these names in any location (e.g.
/tmp), any file may be overwritten with a decimal value.

Diff: diff --git a/device-linux.c b/device-linux.c
index 3bb0beb..709eebc 100644
--- a/device-linux.c
+++ b/device-linux.c
@@ -241,10 +241,14 @@ set_interface_var(const char *iface,
 	FILE *fp;
 	char spath[64+IFNAMSIZ];	/* XXX: magic constant */
 	if (snprintf(spath, sizeof(spath), var, iface) >= sizeof(spath))
 		return -1;
 
+	/* No path traversal */
+	if (strstr(name, "..") || strchr(name, '/'))
+		return -1;
+
 	if (access(spath, F_OK) != 0)
 		return -1;
 
 	fp = fopen(spath, "w");
 	if (!fp) {

Fixed code: 	/* No path traversal */
	if (strstr(name, "..") || strchr(name, '/'))
		return -1;
CVE-2022-4644: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-12-22T01:15Z
Repository: https://github.com/ikus060/rdiffweb
Language: Python
Files changed: README.md, rdiffweb/rdw_app.py
Commit date: 2022-12-06 16:24:08 -0500
Commit message: Discard `X-Forwarded-Host` headers

Diff: diff --git a/README.md b/README.md
index a671f92ad..e3d8cc541 100644
--- a/README.md
+++ b/README.md
@@ -106,10 +106,14 @@ Bug reports should be reported on the Rdiffweb Gitlab at https://gitlab.com/ikus
 
 Professional support for Rdiffweb is available by contacting [IKUS Soft](https://www.ikus-soft.com/en/support/#form).
 
 # Changelog
 
+## Next Release - 2.5.4
+
+* Discard `X-Forwarded-Host` headers
+
 ## 2.5.3 (2022-12-05)
 
 * Add support for WTForms v3 to support Debian Bookworm
 * Fix strange behavior in access token management #247
 
diff --git a/rdiffweb/rdw_app.py b/rdiffweb/rdw_app.py
index 9e48817f5..996d17c78 100644
--- a/rdiffweb/rdw_app.py
+++ b/rdiffweb/rdw_app.py
@@ -83,11 +83,11 @@ cherrypy.config.environments['development'] = {
     mfa_enabled=lambda username: UserObject.get_user(username).mfa == UserObject.ENABLED_MFA,
 )
 @cherrypy.tools.currentuser(userobj=lambda username: UserObject.get_user(username))
 @cherrypy.tools.db()
 @cherrypy.tools.enrich_session()
-@cherrypy.tools.proxy(remote='X-Real-IP')
+@cherrypy.tools.proxy(local=None, remote='X-Real-IP')
 @cherrypy.tools.secure_headers()
 class Root(LocationsPage):
     def __init__(self):
         self.login = LoginPage()
         self.mfa = MfaPage()

Vulnerable code: @cherrypy.tools.proxy(remote='X-Real-IP')
Fixed code: ## Next Release - 2.5.4

* Discard `X-Forwarded-Host` headers

@cherrypy.tools.proxy(local=None, remote='X-Real-IP')
CVE-2023-4138: Allocation of Resources Without Limits or Throttling (CWE-770)
value: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 6.5
Published: 2023-08-03T15:15Z
Repository: https://github.com/ikus060/rdiffweb
Language: Unknown
Commit date: 2023-06-01 18:44:40 +0000
Commit message: Merge branch 'patrik-ratelimit-send-report' into 'master'

Add ratelimit to "send me a status report" to avoid email flooding #272

See merge request ikus-soft/rdiffweb!335
CVE-2022-2713: Insufficient Session Expiration (CWE-613)
value: Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.
CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 9.8
Published: 2022-08-08T15:15Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, lib/Lime/App.php
Commit date: 2022-08-08 01:36:02 +0200
Commit message: Stop execution of code after redirecting

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3d098c95..de813e1b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,10 +5,11 @@
 
 - Add create|update|delete endpoints content item to REST API
 - Add GraphQL mutation saveContentItem to create|update content items
 - Add GraphQL mutation deleteContentItem to delete content items
 - Add app side panel (admin layout)
+- Stop execution of code after redirecting
 
 ## 2.1.2 (2022-08-04)
 
 - 🚨 Fix typo field-contentItemtLink -> Need to re-assign field type contentItemLink 🚨
 - General cleanup + fix typos
diff --git a/lib/Lime/App.php b/lib/Lime/App.php
index 83022586..4db08efb 100644
--- a/lib/Lime/App.php
+++ b/lib/Lime/App.php
@@ -232,10 +232,15 @@ class App implements \ArrayAccess {
                 $this->response->body = Response::$statusCodes[$data];
             }
         }
 
         $this->request->stopped = true;
+
+        $this->trigger('app:request:stop');
+        $this->trigger('after', [true]);
+
+        exit;
     }
 
     /**
     * Returns link based on the base url of the app
     * @param  String $path e.g. /js/myscript.js
@@ -854,10 +859,23 @@ class App implements \ArrayAccess {
         }
 
         $this->response = new Response();
         $this->trigger('before');
 
+        if ($flush) {
+
+            $this->on('app:request:stop', function() {
+
+                if ($this->response->status === 307 && isset($this->response->headers['Location'])) {
+                    \header("Location: {$this->response->headers['Location']}");
+                    exit;
+                }
+
+                $this->response->flush();
+            });
+        }
+
         if (!$this->request->stopped) {
 
             $contents = $this->dispatch($route);
 
             if (!$this->request->stopped) {

Fixed code: - Stop execution of code after redirecting

        $this->trigger('app:request:stop');
        $this->trigger('after', [true]);

        exit;
        if ($flush) {

            $this->on('app:request:stop', function() {

                if ($this->response->status === 307 && isset($this->response->headers['Location'])) {
                    \header("Location: {$this->response->headers['Location']}");
                    exit;
                }

                $this->response->flush();
            });
        }
CVE-2023-0759: Privilege Chaining (CWE-268)
value: Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
CWE description: Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
CVSS v3 base score: 8.8
Published: 2023-02-09T14:15Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, modules/System/Controller/Users.php
Commit date: 2023-02-01 23:52:43 +0100
Commit message: Fix not allowed user role modification by intercepting request

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6d45603e..587710a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,11 @@
 # Release Notes
 
+## WIP
+
+- Fix not allowed user role modification by intercepting request
+
 ## 2.3.7 (2023-01-31)
 
 - Batch update collection items state
 - Add state filter to collection items view
 - Fix possible infinite content population loop
diff --git a/modules/System/Controller/Users.php b/modules/System/Controller/Users.php
index 78f844d0..c53c1706 100644
--- a/modules/System/Controller/Users.php
+++ b/modules/System/Controller/Users.php
@@ -80,10 +80,15 @@ class Users extends App {
 
         if (!$user) {
             return $this->stop(['error' => 'User data is missing'], 412);
         }
 
+        // don't allow to change role if not allowed
+        if (isset($user['role']) && !$this->isAllowed('app/users/manage')) {
+            unset($user['role']);
+        }
+
         $user['_modified'] = time();
         $isUpdate = isset($user['_id']);
 
         if (!$isUpdate) {
 

Fixed code: ## WIP

- Fix not allowed user role modification by intercepting request

        // don't allow to change role if not allowed
        if (isset($user['role']) && !$this->isAllowed('app/users/manage')) {
            unset($user['role']);
        }
CVE-2023-0780: Improper Restriction of Rendered UI Layers or Frames (CWE-1021)
value: Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9-dev.
CWE description: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
CVSS v3 base score: 5.4
Published: 2023-02-11T02:20Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, modules/App/admin.php
Commit date: 2023-02-11 01:44:16 +0100
Commit message: Set X-Frame-Options to prevent possible clickjacking via iframe layer

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index b012a120c..fe3827adc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,12 @@
 # Release Notes
 
 ## WIP
 
 - Fix batch state update (when using MongoLite) #75
+- Fix min/max settings for number fields #76
+- Set X-Frame-Options to prevent possible clickjacking via iframe layer
 
 ## 2.3.8 (2023-02-04)
 
 - Fix not allowed user role modification by intercepting request
 - Fix tree item view #72
diff --git a/modules/App/admin.php b/modules/App/admin.php
index 4471313d4..5412bdc6d 100644
--- a/modules/App/admin.php
+++ b/modules/App/admin.php
@@ -138,10 +138,13 @@ $this->on('app.admin.request', function(Lime\Request $request) {
 /**
  * handle after request
  */
 $this->on('after', function() {
 
+    // prevent possible clickjacking via iframe layer
+    $this->response->headers['X-Frame-Options'] = 'SAMEORIGIN';
+
     // handle error pages
     switch ($this->response->status) {
 
         case 401:
 

Fixed code: - Fix min/max settings for number fields #76
- Set X-Frame-Options to prevent possible clickjacking via iframe layer
    // prevent possible clickjacking via iframe layer
    $this->response->headers['X-Frame-Options'] = 'SAMEORIGIN';
CVE-2023-1313: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2023-03-10T12:15Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, modules/Assets/bootstrap.php
Commit date: 2023-03-10 11:23:51 +0100
Commit message: Prevent uploading php files in assets manager

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e35019d1..bf87dcf2e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,11 @@
 # Release Notes
 
+## WIP
+
+- Prevent uploading php files in assets manager
+
 ## 2.4.0 (2023-03-08)
 
 - Add additional security check editing php files in finder
 - Fix base64 encoding data not in latin char range
 - Add internal bucket storage container feature
diff --git a/modules/Assets/bootstrap.php b/modules/Assets/bootstrap.php
index 185b2ba49..e1c529f4c 100644
--- a/modules/Assets/bootstrap.php
+++ b/modules/Assets/bootstrap.php
@@ -78,10 +78,15 @@ $this->module('assets')->extend([
 
                 $_file  = $this->app->path('#tmp:').'/'.$files['name'][$i];
                 $_isAllowed = $allowed === true ? true : preg_match("/\.({$allowed})$/i", $_file);
                 $_sizeAllowed = $max_size ? filesize($files['tmp_name'][$i]) < $max_size : true;
 
+                // prevent uploading php files
+                if ($_isAllowed && pathinfo($_file, PATHINFO_EXTENSION) === 'php') {
+                    $_isAllowed = false;
+                }
+
                 if (!$files['error'][$i] && $_isAllowed && $_sizeAllowed && move_uploaded_file($files['tmp_name'][$i], $_file)) {
 
                     $_files[]   = $_file;
                     $uploaded[] = $files['name'][$i];
 

Fixed code: ## WIP

- Prevent uploading php files in assets manager

                // prevent uploading php files
                if ($_isAllowed && pathinfo($_file, PATHINFO_EXTENSION) === 'php') {
                    $_isAllowed = false;
                }
CVE-2023-4195: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (CWE-98)
value: PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
CWE description: The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
CVSS v3 base score: 8.8
Published: 2023-08-06T18:15Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, modules/Assets/bootstrap.php
Commit date: 2023-08-06 18:58:38 +0200
Commit message: Prevent uploading .phps files

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee16e4b53..7b5874a8f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,11 @@
 # Release Notes
 
+## WIP
+
+- Prevent uploading .phps files
+
 ## 2.6.2 (2023-07-31)
 
 - Add video frame preview (assets manager)
 - Fix `$not` for MongoLite
 - Add `app.system.install` event trigger on initial installation
diff --git a/modules/Assets/bootstrap.php b/modules/Assets/bootstrap.php
index ec97f0809..df6353f97 100644
--- a/modules/Assets/bootstrap.php
+++ b/modules/Assets/bootstrap.php
@@ -76,11 +76,11 @@ $this->module('assets')->extend([
                 $_file  = $this->app->path('#tmp:').'/'.$files['name'][$i];
                 $_isAllowed = $allowed === true ? true : preg_match("/\.({$allowed})$/i", $_file);
                 $_sizeAllowed = $max_size ? filesize($files['tmp_name'][$i]) < $max_size : true;
 
                 // prevent uploading php files
-                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), ['php', 'phar', 'phtml'])) {
+                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), ['php', 'phar', 'phtml', 'phps'])) {
                     $_isAllowed = false;
                 }
 
                 if (!$files['error'][$i] && $_isAllowed && $_sizeAllowed && move_uploaded_file($files['tmp_name'][$i], $_file)) {
 

Vulnerable code:                 if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), ['php', 'phar', 'phtml'])) {
Fixed code: ## WIP

- Prevent uploading .phps files

                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), ['php', 'phar', 'phtml', 'phps'])) {
CVE-2023-4196: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-08-06T18:15Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, modules/Assets/bootstrap.php
Commit date: 2023-08-06 19:30:37 +0200
Commit message: Prevent uploading .phps + .html files in assets manager

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7b5874a8f..9236ee63d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,10 @@
 # Release Notes
 
 ## WIP
 
-- Prevent uploading .phps files
+- Prevent uploading .phps + .html files in assets manager
 
 ## 2.6.2 (2023-07-31)
 
 - Add video frame preview (assets manager)
 - Fix `$not` for MongoLite
diff --git a/modules/Assets/bootstrap.php b/modules/Assets/bootstrap.php
index df6353f97..a42cbb938 100644
--- a/modules/Assets/bootstrap.php
+++ b/modules/Assets/bootstrap.php
@@ -65,10 +65,12 @@ $this->module('assets')->extend([
 
         $allowed   = $this->app->retrieve('assets/allowed_uploads', '*');
         $allowed   = $allowed == '*' ? true : str_replace([' ', ','], ['', '|'], preg_quote(is_array($allowed) ? implode(',', $allowed) : $allowed));
         $max_size  = $this->app->retrieve('assets/max_upload_size', 0);
 
+        $forbidden = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'htaccess'];
+
         if (isset($files['name']) && is_array($files['name'])) {
 
             $cnt = count($files['name']);
 
             for ($i = 0; $i < $cnt; $i++) {
@@ -76,11 +78,11 @@ $this->module('assets')->extend([
                 $_file  = $this->app->path('#tmp:').'/'.$files['name'][$i];
                 $_isAllowed = $allowed === true ? true : preg_match("/\.({$allowed})$/i", $_file);
                 $_sizeAllowed = $max_size ? filesize($files['tmp_name'][$i]) < $max_size : true;
 
                 // prevent uploading php files
-                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), ['php', 'phar', 'phtml', 'phps'])) {
+                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbidden)) {
                     $_isAllowed = false;
                 }
 
                 if (!$files['error'][$i] && $_isAllowed && $_sizeAllowed && move_uploaded_file($files['tmp_name'][$i], $_file)) {
 

Vulnerable code: - Prevent uploading .phps files
                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), ['php', 'phar', 'phtml', 'phps'])) {
Fixed code: - Prevent uploading .phps + .html files in assets manager
        $forbidden = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'htaccess'];

                if ($_isAllowed && in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbidden)) {
CVE-2023-4321: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.4.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-08-14T11:15Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, modules/Assets/bootstrap.php
Commit date: 2023-08-14 12:24:10 +0200
Commit message: prevent xhtml files from being uploaded in the assets manager

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 090cf4872..ab695c389 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,10 @@
 # Release Notes
 
 ## WIP
 
-- Prevent uploading .phps + .html files in assets manager
+- Prevent uploading .phps + .(x)html files in assets manager
 - Require verification for updating user data
 - Support post field projection after content population (via ..{fieldname})
 - Extract width + height and colors from uploaded svg files
 - Implement HTTP caching when using response cache (via rspc parameter)
 - Resolve `{field}:locale` in filter and sort parameters
diff --git a/modules/Assets/bootstrap.php b/modules/Assets/bootstrap.php
index 3b1f17839..868a5260c 100644
--- a/modules/Assets/bootstrap.php
+++ b/modules/Assets/bootstrap.php
@@ -66,12 +66,15 @@ $this->module('assets')->extend([
 
         $allowed   = $this->app->retrieve('assets/allowed_uploads', '*');
         $allowed   = $allowed == '*' ? true : str_replace([' ', ','], ['', '|'], preg_quote(is_array($allowed) ? implode(',', $allowed) : $allowed));
         $max_size  = $this->app->retrieve('assets/max_upload_size', 0);
 
-        $forbiddenExtension = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'htaccess'];
-        $forbiddenMime = ['application/x-httpd-php', 'text/html'];
+        $forbiddenExtension = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'xhtml', 'htaccess'];
+        $forbiddenMime = [
+            'application/x-httpd-php', 'application/x-php', 'text/x-php',
+            'text/html', 'application/xhtml+xml'
+        ];
 
         if (isset($files['name']) && is_array($files['name'])) {
 
             $cnt = count($files['name']);
 

Vulnerable code: - Prevent uploading .phps + .html files in assets manager
        $forbiddenExtension = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'htaccess'];
        $forbiddenMime = ['application/x-httpd-php', 'text/html'];
Fixed code: - Prevent uploading .phps + .(x)html files in assets manager
        $forbiddenExtension = ['php', 'phar', 'phtml', 'phps', 'htm', 'html', 'xhtml', 'htaccess'];
        $forbiddenMime = [
            'application/x-httpd-php', 'application/x-php', 'text/x-php',
            'text/html', 'application/xhtml+xml'
        ];
CVE-2023-4395: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-08-17T04:15Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, modules/Assets/bootstrap.php
Commit date: 2023-08-17 05:49:10 +0200
Commit message: Fix mime type detection on asset upload

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3753d1099..fe9f6277a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,11 @@
 # Release Notes
 
+## WIP
+
+- Fix mime type detection on asset upload
+
 ## 2.6.3 (2023-08-15)
 
 - Prevent uploading .phps + .(x)html files in assets manager
 - Require verification for updating user data
 - Support post field projection after content population (via ..{fieldname})
diff --git a/modules/Assets/bootstrap.php b/modules/Assets/bootstrap.php
index 868a5260c..f4bffbec5 100644
--- a/modules/Assets/bootstrap.php
+++ b/modules/Assets/bootstrap.php
@@ -79,17 +79,19 @@ $this->module('assets')->extend([
             $cnt = count($files['name']);
 
             for ($i = 0; $i < $cnt; $i++) {
 
                 $_file  = $this->app->path('#tmp:').'/'.$files['name'][$i];
-                $_mime = finfo_file($finfo, $_file);
+                $_mime = $finfo->file($files['tmp_name'][$i]);
                 $_isAllowed = $allowed === true ? true : preg_match("/\.({$allowed})$/i", $_file);
                 $_sizeAllowed = $max_size ? filesize($files['tmp_name'][$i]) < $max_size : true;
 
+                $extension = strtolower(pathinfo(parse_url($_file, PHP_URL_PATH), PATHINFO_EXTENSION));
+
                 // prevent uploading php / html files
                 if ($_isAllowed && (
-                    in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbiddenExtension) ||
+                    in_array($extension, $forbiddenExtension) ||
                     in_array(strtolower($_mime), $forbiddenMime)
                 )) {
                     $_isAllowed = false;
                 }
 

Vulnerable code:                 $_mime = finfo_file($finfo, $_file);
                    in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbiddenExtension) ||
Fixed code: ## WIP

- Fix mime type detection on asset upload

                $_mime = $finfo->file($files['tmp_name'][$i]);
                $extension = strtolower(pathinfo(parse_url($_file, PHP_URL_PATH), PATHINFO_EXTENSION));

                    in_array($extension, $forbiddenExtension) ||
CVE-2023-4433: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-08-19T01:15Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, modules/Assets/bootstrap.php
Commit date: 2023-08-17 05:49:10 +0200
Commit message: Fix mime type detection on asset upload

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3753d1099..fe9f6277a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,11 @@
 # Release Notes
 
+## WIP
+
+- Fix mime type detection on asset upload
+
 ## 2.6.3 (2023-08-15)
 
 - Prevent uploading .phps + .(x)html files in assets manager
 - Require verification for updating user data
 - Support post field projection after content population (via ..{fieldname})
diff --git a/modules/Assets/bootstrap.php b/modules/Assets/bootstrap.php
index 868a5260c..f4bffbec5 100644
--- a/modules/Assets/bootstrap.php
+++ b/modules/Assets/bootstrap.php
@@ -79,17 +79,19 @@ $this->module('assets')->extend([
             $cnt = count($files['name']);
 
             for ($i = 0; $i < $cnt; $i++) {
 
                 $_file  = $this->app->path('#tmp:').'/'.$files['name'][$i];
-                $_mime = finfo_file($finfo, $_file);
+                $_mime = $finfo->file($files['tmp_name'][$i]);
                 $_isAllowed = $allowed === true ? true : preg_match("/\.({$allowed})$/i", $_file);
                 $_sizeAllowed = $max_size ? filesize($files['tmp_name'][$i]) < $max_size : true;
 
+                $extension = strtolower(pathinfo(parse_url($_file, PHP_URL_PATH), PATHINFO_EXTENSION));
+
                 // prevent uploading php / html files
                 if ($_isAllowed && (
-                    in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbiddenExtension) ||
+                    in_array($extension, $forbiddenExtension) ||
                     in_array(strtolower($_mime), $forbiddenMime)
                 )) {
                     $_isAllowed = false;
                 }
 

Vulnerable code:                 $_mime = finfo_file($finfo, $_file);
                    in_array(strtolower(pathinfo($_file, PATHINFO_EXTENSION)), $forbiddenExtension) ||
Fixed code: ## WIP

- Fix mime type detection on asset upload

                $_mime = $finfo->file($files['tmp_name'][$i]);
                $extension = strtolower(pathinfo(parse_url($_file, PHP_URL_PATH), PATHINFO_EXTENSION));

                    in_array($extension, $forbiddenExtension) ||
CVE-2023-4451: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-08-20T15:15Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, install/index.php
Commit date: 2023-08-20 16:03:34 +0200
Commit message: sanitize space name during installation

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 966dd1561..3e2bb2bd0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,10 +3,11 @@
 ## WIP
 
 - Fix mime type detection on asset upload
 - Fix possible Cross-site Scripting (XSS) in Rest/GraphQL viewer
 - Add src setting for slect and tag fields to load options from internal sources
+- Sanitize space name during installation
 
 ## 2.6.3 (2023-08-15)
 
 - Prevent uploading .phps + .(x)html files in assets manager
 - Require verification for updating user data
diff --git a/install/index.php b/install/index.php
index 5215ddef7..257ba57e6 100644
--- a/install/index.php
+++ b/install/index.php
@@ -56,11 +56,11 @@ $APP_SPACE_DIR = dirname(__DIR__);
 $APP_SPACE = null;
 
 // support ?space=myenv to install custom cockpit instance from /.spaces/*
 if (isset($_GET['space']) && $_GET['space']) {
 
-    $APP_SPACE = $_GET['space'];
+    $APP_SPACE = preg_replace('/[^a-z0-9\-_]/', '', $_GET['space']);
     $spaceDir  = $APP_SPACE_DIR."/.spaces/{$APP_SPACE}";
 
     if (!file_exists($spaceDir)) {
         $failed[] = "Space :{$APP_SPACE}: does not exist!";
     } else {

Vulnerable code:     $APP_SPACE = $_GET['space'];
Fixed code: - Sanitize space name during installation
    $APP_SPACE = preg_replace('/[^a-z0-9\-_]/', '', $_GET['space']);
CVE-2022-25896: Session Fixation (CWE-384)
value: This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 4.8
Published: 2022-07-01T20:15Z
Repository: https://github.com/jaredhanson/passport
Language: JavaScript
Files changed: lib/sessionmanager.js
Commit date: 2022-05-17 08:15:54 -0700
Commit message: Regenerate session on login.

Diff: diff --git a/lib/sessionmanager.js b/lib/sessionmanager.js
index 3d5c51c..8647b9c 100644
--- a/lib/sessionmanager.js
+++ b/lib/sessionmanager.js
@@ -8,28 +8,38 @@ function SessionManager(options, serializeUser) {
   this._key = options.key || 'passport';
   this._serializeUser = serializeUser;
 }
 
 SessionManager.prototype.logIn = function(req, user, cb) {
+  console.log('SM: logIn');
+  
   var self = this;
-  this._serializeUser(user, req, function(err, obj) {
+  req.session.regenerate(function(err) {
     if (err) {
       return cb(err);
     }
-    // TODO: Error if session isn't available here.
-    if (!req.session) {
-      req.session = {};
-    }
-    if (!req.session[self._key]) {
-      req.session[self._key] = {};
-    }
-    req.session[self._key].user = obj;
-    cb();
+    
+    self._serializeUser(user, req, function(err, obj) {
+      if (err) {
+        return cb(err);
+      }
+      // TODO: Error if session isn't available here.
+      if (!req.session) {
+        req.session = {};
+      }
+      if (!req.session[self._key]) {
+        req.session[self._key] = {};
+      }
+      req.session[self._key].user = obj;
+      cb();
+    });
   });
 }
 
 SessionManager.prototype.logOut = function(req, cb) {
+  console.log('SM: logOut');
+  
   if (req.session && req.session[this._key]) {
     delete req.session[this._key].user;
   }
   
   cb && cb();

Vulnerable code:   this._serializeUser(user, req, function(err, obj) {
    // TODO: Error if session isn't available here.
    if (!req.session) {
      req.session = {};
    }
    if (!req.session[self._key]) {
      req.session[self._key] = {};
    }
    req.session[self._key].user = obj;
    cb();
Fixed code:   console.log('SM: logIn');
  
  req.session.regenerate(function(err) {
    
    self._serializeUser(user, req, function(err, obj) {
      if (err) {
        return cb(err);
      }
      // TODO: Error if session isn't available here.
      if (!req.session) {
        req.session = {};
      }
      if (!req.session[self._key]) {
        req.session[self._key] = {};
      }
      req.session[self._key].user = obj;
      cb();
    });
  console.log('SM: logOut');