CVE-2017-5494: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a (1) comment frame or (2) avatar frame.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-01-15T22:59Z
Repository: https://github.com/b2evolution/b2evolution
Language: PHP
Files changed: conf/_application.php, install/_functions_create.php, install/_functions_evoupgrade.php
Commit date: 2017-01-15 15:17:52 +0800
Commit message: Updated file types table to only allow admins to upload files with SWF extension

Diff: diff --git a/conf/_application.php b/conf/_application.php
index 9e34c30c12..fc5f12fe77 100644
--- a/conf/_application.php
+++ b/conf/_application.php
@@ -34,11 +34,11 @@ $app_version_long = $app_version.'-'.$app_date;
  * This will be incrememented by 5 with each change in {@link upgrade_b2evo_tables()}
  * in order to leave space for maintenance releases.
  *
  * {@internal Before changing this in CVS, it should be discussed! }}
  */
-$new_db_version = 11810;
+$new_db_version = 11815;
 
 /**
  * Minimum PHP version required for b2evolution to function properly. It will contain each module own minimum PHP version as well.
  * @global array
  */
diff --git a/install/_functions_create.php b/install/_functions_create.php
index 0e5b45ecbf..93038ac894 100644
--- a/install/_functions_create.php
+++ b/install/_functions_create.php
@@ -446,11 +446,11 @@ function create_default_data()
 			(15, 'm4a', 'MPEG audio file', 'audio/x-m4a', 'file_sound', 'browser', 'registered'),
 			(16, 'mp4 f4v', 'MPEG video', 'video/mp4', 'file_video', 'browser', 'registered'),
 			(17, 'mov', 'Quicktime video', 'video/quicktime', 'file_video', 'browser', 'registered'),
 			(18, 'm4v', 'MPEG video file', 'video/x-m4v', 'file_video', 'browser', 'registered'),
 			(19, 'flv', 'Flash video file', 'video/x-flv', 'file_video', 'browser', 'registered'),
-			(20, 'swf', 'Flash video file', 'application/x-shockwave-flash', 'file_video', 'browser', 'registered'),
+			(20, 'swf', 'Flash video file', 'application/x-shockwave-flash', 'file_video', 'browser', 'admin'),
 			(21, 'webm', 'WebM video file', 'video/webm', 'file_video', 'browser', 'registered'),
 			(22, 'ogv', 'Ogg video file', 'video/ogg', 'file_video', 'browser', 'registered'),
 			(23, 'm3u8', 'M3U8 video file', 'application/x-mpegurl', 'file_video', 'browser', 'registered'),
 			(24, 'xml', 'XML file', 'application/xml', 'file_www', 'browser', 'admin')
 		" );
diff --git a/install/_functions_evoupgrade.php b/install/_functions_evoupgrade.php
index 3435fca6d4..18c0520198 100644
--- a/install/_functions_evoupgrade.php
+++ b/install/_functions_evoupgrade.php
@@ -7590,10 +7590,18 @@ function upgrade_b2evo_tables( $upgrade_action = 'evoupgrade' )
 		$DB->query( 'ALTER TABLE T_plugins
 			MODIFY plug_priority TINYINT UNSIGNED NOT NULL default 50' );
 		upg_task_end();
 	}
 
+	if( upg_task_start( 11815, 'Updating file types table...' ) )
+	{ // part of 6.7.10-stable
+		$DB->query( 'UPDATE T_filetypes
+				SET ftyp_allowed = "admin"
+			WHERE ftyp_extensions REGEXP "[[:<:]]swf[[:>:]]"' );
+		upg_task_end();
+	}
+
 	/*
 	 * ADD UPGRADES __ABOVE__ IN A NEW UPGRADE BLOCK.
 	 *
 	 * YOU MUST USE:
 	 * task_begin( 'Descriptive text about action...' );

Vulnerable code: $new_db_version = 11810;
			(20, 'swf', 'Flash video file', 'application/x-shockwave-flash', 'file_video', 'browser', 'registered'),
Fixed code: $new_db_version = 11815;
			(20, 'swf', 'Flash video file', 'application/x-shockwave-flash', 'file_video', 'browser', 'admin'),
	if( upg_task_start( 11815, 'Updating file types table...' ) )
	{ // part of 6.7.10-stable
		$DB->query( 'UPDATE T_filetypes
				SET ftyp_allowed = "admin"
			WHERE ftyp_extensions REGEXP "[[:<:]]swf[[:>:]]"' );
		upg_task_end();
	}