CVE-2022-0930: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-03-12T14:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/functions/plupload.php, src/MicroweberPackages/Utils/System/Files.php
Commit date: 2022-03-11 15:27:10 +0200
Commit message: make plupload only allowed files

Diff: diff --git a/src/MicroweberPackages/App/functions/plupload.php b/src/MicroweberPackages/App/functions/plupload.php
index 804f29f9683a..501045045f8b 100644
--- a/src/MicroweberPackages/App/functions/plupload.php
+++ b/src/MicroweberPackages/App/functions/plupload.php
@@ -54,13 +54,13 @@ if(defined('MW_IS_MULTISITE') and MW_IS_MULTISITE){
 $fileName_ext = isset($_REQUEST['name']) ? $_REQUEST['name'] : '';
 
 $is_ext = get_file_extension($fileName_ext);
 $is_ext = strtolower($is_ext);
 
-$is_dangerous_file = $files_utils->is_dangerous_file($fileName_ext);
+$is_allowed_file = $files_utils->is_allowed_file($fileName_ext);
 
-if ($is_dangerous_file) {
+if ($is_allowed_file == false) {
     header("HTTP/1.1 401 Unauthorized");
 
     die('{"jsonrpc" : "2.0", "error" : {"code":100, "message": "You cannot upload scripts or executable files"}}');
 }
 
diff --git a/src/MicroweberPackages/Utils/System/Files.php b/src/MicroweberPackages/Utils/System/Files.php
index 12b120ab4a88..49569f65861a 100644
--- a/src/MicroweberPackages/Utils/System/Files.php
+++ b/src/MicroweberPackages/Utils/System/Files.php
@@ -1018,11 +1018,11 @@ class Files
             'rt',
             'esproj',
             'private',
             'srl',
             'zhtml',
-            'vbhtml', 
+            'vbhtml',
             'hypetemplate',
             'obml15',
             'hypesymbol',
             'pub',
             'ece',
@@ -1107,25 +1107,51 @@ class Files
             return true;
         }
 
     }
 
+    public function is_allowed_file($fileName)
+    {
+        $allowedImages = $this->get_allowed_files_extensions_for_upload('images');
+        $allowedVideos = $this->get_allowed_files_extensions_for_upload('videos');
+        $allowedAudios = $this->get_allowed_files_extensions_for_upload('audios');
+        $allowedFiles = $this->get_allowed_files_extensions_for_upload('files');
+        $allowedDocuments = $this->get_allowed_files_extensions_for_upload('documents');
+        $allowedArchives = $this->get_allowed_files_extensions_for_upload('archives');
+
+        $allowed = array_merge_recursive($allowedImages,$allowedVideos,$allowedAudios,$allowedFiles,$allowedDocuments,$allowedArchives);
+
+        $isExt = get_file_extension($fileName);
+        $isExt = strtolower($isExt);
+
+        if (in_array($isExt, $allowed)) {
+            return true;
+        }
+
+        return false;
+    }
+
+
 
     function get_allowed_files_extensions_for_upload($fileTypes = 'images')
     {
 
         $are_allowed = '';
         switch ($fileTypes) {
 
             case 'img':
             case 'image':
             case 'images':
-                $are_allowed .= ',png,gif,jpg,jpeg,tiff,bmp,svg';
+                $are_allowed .= ',png,gif,jpg,jpeg,tiff,bmp,svg,webp,ico';
+                break;
+            case 'audio':
+            case 'audios':
+                $are_allowed .= ',mp3,mp4,ogg,wav,flac';
                 break;
             case 'video':
             case 'videos':
-                $are_allowed .= ',avi,asf,mpg,mpeg,mp4,flv,mkv,webm,ogg,wma,mov,wmv';
+                $are_allowed .= ',avi,asf,mpg,mpeg,mp4,flv,mkv,webm,ogg,ogv,3gp,3g2,wma,mov,wmv';
                 break;
             case 'file':
             case 'files':
                 $are_allowed .= ',doc,docx,pdf,html,js,css,htm,rtf,txt,zip,gzip,rar,cad,xml,psd,xlsx,csv,7z';
                 break;

Vulnerable code: $is_dangerous_file = $files_utils->is_dangerous_file($fileName_ext);
if ($is_dangerous_file) {
            'vbhtml', 
                $are_allowed .= ',png,gif,jpg,jpeg,tiff,bmp,svg';
                $are_allowed .= ',avi,asf,mpg,mpeg,mp4,flv,mkv,webm,ogg,wma,mov,wmv';
Fixed code: $is_allowed_file = $files_utils->is_allowed_file($fileName_ext);
if ($is_allowed_file == false) {
            'vbhtml',
    public function is_allowed_file($fileName)
    {
        $allowedImages = $this->get_allowed_files_extensions_for_upload('images');
        $allowedVideos = $this->get_allowed_files_extensions_for_upload('videos');
        $allowedAudios = $this->get_allowed_files_extensions_for_upload('audios');
        $allowedFiles = $this->get_allowed_files_extensions_for_upload('files');
        $allowedDocuments = $this->get_allowed_files_extensions_for_upload('documents');
        $allowedArchives = $this->get_allowed_files_extensions_for_upload('archives');

        $allowed = array_merge_recursive($allowedImages,$allowedVideos,$allowedAudios,$allowedFiles,$allowedDocuments,$allowedArchives);

        $isExt = get_file_extension($fileName);
        $isExt = strtolower($isExt);

        if (in_array($isExt, $allowed)) {
            return true;
        }

        return false;
    }


                $are_allowed .= ',png,gif,jpg,jpeg,tiff,bmp,svg,webp,ico';
                break;
            case 'audio':
            case 'audios':
                $are_allowed .= ',mp3,mp4,ogg,wav,flac';
                $are_allowed .= ',avi,asf,mpg,mpeg,mp4,flv,mkv,webm,ogg,ogv,3gp,3g2,wma,mov,wmv';