CVE-2022-0409: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.8
Published: 2022-02-19T05:15Z
Repository: https://github.com/star7th/showdoc
Language: PHP
Files changed: server/Application/Api/Controller/AttachmentController.class.php, server/Application/Api/Model/AttachmentModel.class.php
Commit date: 2022-01-26 20:38:00 +0800
Commit message: File upload vulnerability

Diff: diff --git a/server/Application/Api/Controller/AttachmentController.class.php b/server/Application/Api/Controller/AttachmentController.class.php
index 296cb649a..d0a67616a 100644
--- a/server/Application/Api/Controller/AttachmentController.class.php
+++ b/server/Application/Api/Controller/AttachmentController.class.php
@@ -76,15 +76,12 @@ class AttachmentController extends BaseController {
         }
         
         if (!$_FILES['editormd-image-file']) {
            return false;
         }
-        
-        if (strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".php") 
-            || strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".htm") 
-            || strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".svg") 
-            ) {
+
+        if(D("Attachment")->isDangerFilename($_FILES['editormd-image-file']['name'])){
             return false;
         }
 
         $url = D("Attachment")->upload($_FILES , 'editormd-image-file' , $login_user['uid'] , $item_id , $page_id ) ;
         if ($url) {
@@ -109,16 +106,12 @@ class AttachmentController extends BaseController {
         }
         
         if (!$uploadFile) {
            return false;
         }
-        
-        if (strstr(strip_tags(strtolower($uploadFile['name'])), ".php") 
-            || strstr(strip_tags(strtolower($uploadFile['name'])), ".htm") 
-            || strstr(strip_tags(strtolower($uploadFile['name'])), ".svg") 
-            
-            ) {
+
+        if(D("Attachment")->isDangerFilename($uploadFile['name'])){
             $this->sendError(10100,'不支持此文件类型');
             return false;
         }
 
         $url = D("Attachment")->upload($_FILES , 'file' , $login_user['uid'] , $item_id , $page_id ) ;
diff --git a/server/Application/Api/Model/AttachmentModel.class.php b/server/Application/Api/Model/AttachmentModel.class.php
index fca86680e..3d76105b8 100644
--- a/server/Application/Api/Model/AttachmentModel.class.php
+++ b/server/Application/Api/Model/AttachmentModel.class.php
@@ -55,17 +55,14 @@ class AttachmentModel extends BaseModel {
 
 	//上传文件，返回url
 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if (strstr(strip_tags(strtolower($uploadFile['name'])), ".php")
-		||  strstr(strip_tags(strtolower($uploadFile['name'])), ".php")
-		||  strstr(strip_tags(strtolower($uploadFile['name'])), ".svg")
-		
-		) {
+		if($this->isDangerFilename($uploadFile['name'])){
 			return false;
-	}
+		}
+
 		$oss_open = D("Options")->get("oss_open" ) ;
 		if ($oss_open) {
 				$url = $this->uploadOss($uploadFile);
 				if ($url) {
 						$sign = md5($url.time().rand()) ;
@@ -288,8 +285,29 @@ class AttachmentModel extends BaseModel {
 
 		}
 
 	}
 
+	// 判断文件名是否包含危险的扩展名
+	public function isDangerFilename($filename){
+
+		$isDangerStr = function ($filename , $keyword){
+			if(strstr(strip_tags(strtolower( $filename )), $keyword) ){
+				return true ;
+			}
+			return false;
+		};
+		if (
+			 $isDangerStr($filename , ".php")
+			|| $isDangerStr($filename , ".svg")
+			|| $isDangerStr($filename , ".htm")
+			|| $isDangerStr($filename , "%")
+		) {
+			return true;
+		}
+	
+		return false;
+	}
+
 
 
 }
\ No newline at end of file

Vulnerable code:         
        if (strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".php") 
            || strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".htm") 
            || strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".svg") 
            ) {
        
        if (strstr(strip_tags(strtolower($uploadFile['name'])), ".php") 
            || strstr(strip_tags(strtolower($uploadFile['name'])), ".htm") 
            || strstr(strip_tags(strtolower($uploadFile['name'])), ".svg") 
            
            ) {
		if (strstr(strip_tags(strtolower($uploadFile['name'])), ".php")
		||  strstr(strip_tags(strtolower($uploadFile['name'])), ".php")
		||  strstr(strip_tags(strtolower($uploadFile['name'])), ".svg")
		
		) {
	}
Fixed code: 
        if(D("Attachment")->isDangerFilename($_FILES['editormd-image-file']['name'])){

        if(D("Attachment")->isDangerFilename($uploadFile['name'])){
		if($this->isDangerFilename($uploadFile['name'])){
		}

	// 判断文件名是否包含危险的扩展名
	public function isDangerFilename($filename){

		$isDangerStr = function ($filename , $keyword){
			if(strstr(strip_tags(strtolower( $filename )), $keyword) ){
				return true ;
			}
			return false;
		};
		if (
			 $isDangerStr($filename , ".php")
			|| $isDangerStr($filename , ".svg")
			|| $isDangerStr($filename , ".htm")
			|| $isDangerStr($filename , "%")
		) {
			return true;
		}
	
		return false;
	}