CVE-2014-7235: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth cookie, related to the PHP unserialize function, as exploited in the wild in September 2014.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Published: 2014-10-07T14:55Z
Repository: https://github.com/FreePBX/fw_ari
Language: PHP
Files changed: htdocs_ari/includes/login.php, module.xml
Commit date: 2014-09-30 19:42:59 -0400
Commit message: FREEPBX-8070 Turn all serialized into json

Diff: diff --git a/htdocs_ari/includes/login.php b/htdocs_ari/includes/login.php
index 3c03509..1370c61 100644
--- a/htdocs_ari/includes/login.php
+++ b/htdocs_ari/includes/login.php
@@ -51,15 +51,20 @@ class Login {
 
     // get the ari authentication cookie 
     $data = '';
     $chksum = '';
     if (isset($_COOKIE['ari_auth'])) {
-      $buf = unserialize(stripslashes($_COOKIE['ari_auth']));
-      list($data,$chksum) = $buf;
+      $buf = json_decode($_COOKIE['ari_auth'],true);
+      if(!is_array($buf)) {
+        $data = false;
+        $chksum = false;
+      } else {
+        list($data,$chksum) = $buf;
+      }
     }
     if (md5($data) == $chksum) {
-      $data = unserialize($crypt->decrypt($data,$ARI_CRYPT_PASSWORD));
+      $data = json_decode($crypt->decrypt($data,$ARI_CRYPT_PASSWORD),true);
       $username = $data['username'];
       $password = $data['password'];
     }
 
     if (isset($_POST['username']) && 
@@ -288,15 +293,15 @@ class Login {
         $remember = $_POST['remember'];
       }
       if ($auth && $remember) {
 
         $data = array('username' => $username, 'password' => $password);
-        $data = $crypt->encrypt(serialize($data),$ARI_CRYPT_PASSWORD);
+        $data = $crypt->encrypt(json_encode($data),$ARI_CRYPT_PASSWORD);
 
         $chksum = md5($data);
 
-        $buf = serialize(array($data,$chksum));
+        $buf = json_encode(array($data,$chksum));
         setcookie('ari_auth',$buf,time()+365*24*60*60,'/');
       }
 
       // set category
       if (!$category) {
@@ -482,6 +487,6 @@ class Login {
 
 
 }
 
 
-?>
\ No newline at end of file
+?>
diff --git a/module.xml b/module.xml
index 0a46555..0d204fa 100644
--- a/module.xml
+++ b/module.xml
@@ -1,15 +1,16 @@
 <module>
 	<rawname>fw_ari</rawname>
 	<modtype>framework</modtype>
 	<repo>standard</repo>
 	<name>FreePBX ARI Framework</name>
-	<version>2.11.1.4</version>
+	<version>2.11.1.5</version>
 	<publisher>Schmooze Com Inc</publisher>
 	<license>GPLv3+</license>
 	<licenselink>http://www.gnu.org/licenses/gpl-3.0.txt</licenselink>
 	<changelog>
+		*2.11.1.5* FREEPBX-8070 SECURITY ISSUE Exec shell on a host using bug in Asterisk Recording Interface index.php
 		*2.11.1.4* Force removal of User Panel Tab
 		*2.11.1.3* Delete user panel tab because it comes from this module now
 		*2.11.1.2* Resolve issue of user panel tab removement
 		*2.11.1.1* Tweaks
 		*2.11.1.0* Allow uninstall and fix for 12 if needed or wanted

Vulnerable code:       $buf = unserialize(stripslashes($_COOKIE['ari_auth']));
      list($data,$chksum) = $buf;
      $data = unserialize($crypt->decrypt($data,$ARI_CRYPT_PASSWORD));
        $data = $crypt->encrypt(serialize($data),$ARI_CRYPT_PASSWORD);
        $buf = serialize(array($data,$chksum));
?>
	<version>2.11.1.4</version>
Fixed code:       $buf = json_decode($_COOKIE['ari_auth'],true);
      if(!is_array($buf)) {
        $data = false;
        $chksum = false;
      } else {
        list($data,$chksum) = $buf;
      }
      $data = json_decode($crypt->decrypt($data,$ARI_CRYPT_PASSWORD),true);
        $data = $crypt->encrypt(json_encode($data),$ARI_CRYPT_PASSWORD);
        $buf = json_encode(array($data,$chksum));
?>
	<version>2.11.1.5</version>
		*2.11.1.5* FREEPBX-8070 SECURITY ISSUE Exec shell on a host using bug in Asterisk Recording Interface index.php