CVE-2023-25655: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-03-23T20:15Z
Repository: https://github.com/baserproject/basercms
Language: PHP
Files changed: lib/Baser/Model/Behavior/BcUploadBehavior.php
Commit date: 2023-02-27 15:13:19 +0900
Commit message: fix CVE-2023-25655

validation errorが発生してもファイルを保存してしまう処理の改善

Diff: diff --git a/lib/Baser/Model/Behavior/BcUploadBehavior.php b/lib/Baser/Model/Behavior/BcUploadBehavior.php
index a89602e04d5..f47b1cf9c7c 100755
--- a/lib/Baser/Model/Behavior/BcUploadBehavior.php
+++ b/lib/Baser/Model/Behavior/BcUploadBehavior.php
@@ -99,19 +99,24 @@ class BcUploadBehavior extends ModelBehavior
 	/**
 	 * After Validate
 	 *
 	 * @param Model $Model
 	 * @param array $options
-	 * @return mixed
+	 * @return void
 	 */
 	public function afterValidate(Model $Model, $options = [])
 	{
-		if($this->validatingLock[$Model->alias]) return true;
-        $Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupRequestData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
-        $Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupTmpData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
-        $this->oldEntity[$Model->alias] = (!empty($Model->data[$Model->alias]['id']))? $this->getOldEntity($Model, $Model->data[$Model->alias]['id']) : [];
-        $this->validatingLock[$Model->alias] = true;
+		if ($Model->validationErrors) {
+			return;
+		}
+		if ($this->validatingLock[$Model->alias]) {
+			return;
+		}
+		$Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupRequestData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
+		$Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupTmpData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
+		$this->oldEntity[$Model->alias] = (!empty($Model->data[$Model->alias]['id']))? $this->getOldEntity($Model, $Model->data[$Model->alias]['id']) : [];
+		$this->validatingLock[$Model->alias] = true;
 
 		// @deprecated 後方互換 since v4.5.6, v5.0.0 で削除予定
 		// CuApprover-4.3.2以下に対応するための処理
 		// バリデーションを配列で実行させるため配列に変換
 		// >>>
@@ -131,12 +136,10 @@ class BcUploadBehavior extends ModelBehavior
 					}
 				}
 			}
 		}
 		// <<<
-
-        return true;
 	}
 
 	/**
 	 * before save
 	 *

Vulnerable code: 	 * @return mixed
		if($this->validatingLock[$Model->alias]) return true;
        $Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupRequestData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
        $Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupTmpData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
        $this->oldEntity[$Model->alias] = (!empty($Model->data[$Model->alias]['id']))? $this->getOldEntity($Model, $Model->data[$Model->alias]['id']) : [];
        $this->validatingLock[$Model->alias] = true;

        return true;
Fixed code: 	 * @return void
		if ($Model->validationErrors) {
			return;
		}
		if ($this->validatingLock[$Model->alias]) {
			return;
		}
		$Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupRequestData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
		$Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupTmpData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
		$this->oldEntity[$Model->alias] = (!empty($Model->data[$Model->alias]['id']))? $this->getOldEntity($Model, $Model->data[$Model->alias]['id']) : [];
		$this->validatingLock[$Model->alias] = true;