CVE-2023-45152: Server-Side Request Forgery (SSRF) (CWE-918)
value: Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 2.3
Published: 2023-10-17T00:15Z
Repository: https://github.com/engelsystem/engelsystem
Language: PHP
Files changed: src/Helpers/Schedule/XmlParser.php, tests/Unit/Helpers/Schedule/Assets/schedule-invalid.html, tests/Unit/Helpers/Schedule/XmlParserTest.php
Commit date: 2023-09-18 17:27:15 +0200
Commit message: Schedule import: Show error message on schedule parsing errors

Diff: diff --git a/src/Helpers/Schedule/XmlParser.php b/src/Helpers/Schedule/XmlParser.php
index 0a1bebe0..27419820 100644
--- a/src/Helpers/Schedule/XmlParser.php
+++ b/src/Helpers/Schedule/XmlParser.php
@@ -13,12 +13,11 @@ class XmlParser
 
     protected Schedule $schedule;
 
     public function load(string $xml): bool
     {
-        $scheduleXML = simplexml_load_string($xml);
-
+        $scheduleXML = simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOWARNING | LIBXML_NOERROR);
         if (!$scheduleXML) {
             return false;
         }
 
         $this->scheduleXML = $scheduleXML;
diff --git a/tests/Unit/Helpers/Schedule/Assets/schedule-invalid.html b/tests/Unit/Helpers/Schedule/Assets/schedule-invalid.html
new file mode 100644
index 00000000..da99e808
--- /dev/null
+++ b/tests/Unit/Helpers/Schedule/Assets/schedule-invalid.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html lang="">
+<head>
+    <title>I'm HTML!</title>
+</head>
+<body>
+This is not a schedule<br>
+and thus must be ignored.
+</body>
+</html>
diff --git a/tests/Unit/Helpers/Schedule/XmlParserTest.php b/tests/Unit/Helpers/Schedule/XmlParserTest.php
index 6a41b6d7..6af982bd 100644
--- a/tests/Unit/Helpers/Schedule/XmlParserTest.php
+++ b/tests/Unit/Helpers/Schedule/XmlParserTest.php
@@ -21,16 +21,17 @@ class XmlParserTest extends TestCase
      * @covers \Engelsystem\Helpers\Schedule\XmlParser::getListFromSequence
      * @covers \Engelsystem\Helpers\Schedule\XmlParser::getSchedule
      */
     public function testLoad(): void
     {
-        libxml_use_internal_errors(true);
-
         $parser = new XmlParser();
 
         // Invalid XML
         $this->assertFalse($parser->load('foo'));
+        // Invalid schedule
+        $this->assertFalse($parser->load(file_get_contents(__DIR__ . '/Assets/schedule-invalid.html')));
+
         // Minimal import
         $this->assertTrue($parser->load(file_get_contents(__DIR__ . '/Assets/schedule-minimal.xml')));
         // Basic import
         $this->assertTrue($parser->load(file_get_contents(__DIR__ . '/Assets/schedule-basic.xml')));
         // Extended import

Vulnerable code:         $scheduleXML = simplexml_load_string($xml);

        libxml_use_internal_errors(true);

Fixed code:         $scheduleXML = simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOWARNING | LIBXML_NOERROR);
<!DOCTYPE html>
<html lang="">
<head>
    <title>I'm HTML!</title>
</head>
<body>
This is not a schedule<br>
and thus must be ignored.
</body>
</html>
        // Invalid schedule
        $this->assertFalse($parser->load(file_get_contents(__DIR__ . '/Assets/schedule-invalid.html')));