CVE-2015-5721: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2016-09-03T20:59Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/TemplatesController.php, app/View/Templates/populate_event_from_template_attributes.ctp
Commit date: 2015-07-01 08:38:40 +0200
Commit message: Security fix: Fix to a possible PHP Object injection

- unserialized user input replaced with json_decode

Diff: diff --git a/app/Controller/TemplatesController.php b/app/Controller/TemplatesController.php
index 8117f5b8..59de3538 100644
--- a/app/Controller/TemplatesController.php
+++ b/app/Controller/TemplatesController.php
@@ -20,16 +20,13 @@ class TemplatesController extends AppController {
 			)
 	);
 
 	public function beforeFilter() { // TODO REMOVE
 		parent::beforeFilter();
-		$this->Security->unlockedActions = array('saveElementSorting', 'populateEventFromTemplate', 'uploadFile', 'deleteTemporaryFile');
+		$this->Security->unlockedActions = array('uploadFile', 'deleteTemporaryFile');
 	}
 	
-	public function fetchFormFromTemplate($id) {
-		
-	}
 	
 	public function index() {
 		$conditions = array();
 		if (!$this->_isSiteAdmin()) {
 			$conditions['OR'] = array('org' => $this->Auth->user('org'), 'share' => true);
@@ -134,10 +131,11 @@ class TemplatesController extends AppController {
 		$this->set('id', $id);
 		$this->set('template', $template);
 	}
 	
 	public function add() {
+		if (!$this->userRole['perm_template']) throw new MethodNotAllowedException('You are not authorised to do that.');
 		if ($this->request->is('post')) {
 			unset($this->request->data['Template']['tagsPusher']);
 			$tags = $this->request->data['Template']['tags'];
 			unset($this->request->data['Template']['tags']);
 			$this->request->data['Template']['org'] = $this->Auth->user('org');
@@ -330,11 +328,11 @@ class TemplatesController extends AppController {
 					$this->Event->EventTag->save(array('event_id' => $event_id, 'tag_id' => $tag['tag_id']));
 				}
 			}
 			
 			if (isset($this->request->data['Template']['attributes'])) {
-				$attributes = unserialize($this->request->data['Template']['attributes']);
+				$attributes = json_decode($this->request->data['Template']['attributes'], true);
 				$this->loadModel('Attribute');
 				$fails = 0;
 				foreach($attributes as $k => &$attribute) {
 					if (isset($attribute['data'])) {
 						$file = new File(APP . 'tmp/files/' . $attribute['data']);
diff --git a/app/View/Templates/populate_event_from_template_attributes.ctp b/app/View/Templates/populate_event_from_template_attributes.ctp
index c2a44f5c..45a9f4a5 100644
--- a/app/View/Templates/populate_event_from_template_attributes.ctp
+++ b/app/View/Templates/populate_event_from_template_attributes.ctp
@@ -27,11 +27,11 @@ endforeach;?>
 				<?php 
 					echo $this->Form->input('attributes', array(
 							'id' => 'attributes',
 							'label' => false,
 							'type' => 'hidden',
-							'value' => serialize($attributes),
+							'value' => json_encode($attributes),
 					));
 				?>
 			</fieldset>
 		<?php
 		echo $this->Form->button('Finalise', array('class' => 'btn btn-primary'));

Vulnerable code: 		$this->Security->unlockedActions = array('saveElementSorting', 'populateEventFromTemplate', 'uploadFile', 'deleteTemporaryFile');
	public function fetchFormFromTemplate($id) {
		
	}
				$attributes = unserialize($this->request->data['Template']['attributes']);
							'value' => serialize($attributes),
Fixed code: 		$this->Security->unlockedActions = array('uploadFile', 'deleteTemporaryFile');
		if (!$this->userRole['perm_template']) throw new MethodNotAllowedException('You are not authorised to do that.');
				$attributes = json_decode($this->request->data['Template']['attributes'], true);
							'value' => json_encode($attributes),