CVE-2022-24780: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 8.8
Published: 2022-04-05T19:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php, datamodels/2.x/itop-tickets/datamodel.itop-tickets.xml
Commit date: 2021-12-09 12:08:23 +0100
Commit message: N°4384 Security hardening
Module parameter flag for extensions

Diff: diff --git a/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php b/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
index 4ae7dde85d..724e68f07f 100644
--- a/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
+++ b/datamodels/2.x/itop-portal-base/portal/src/Form/ObjectFormManager.php
@@ -83,30 +83,35 @@ class ObjectFormManager extends FormManager
 	 * @since 2.7.5
 	 */
 	protected $aHiddenFieldsId = array();
 
 	/**
-	 * Creates an instance of \Combodo\iTop\Portal\Form\ObjectFormManager from JSON data that must contain at least :
-	 * - formobject_class : The class of the object that is being edited/viewed
-	 * - formmode : view|edit|create
-	 * - values for parent
+	 * @param string $sJson JSON data that must contain at least :
+	 *       - formobject_class : The class of the object that is being edited/viewed
+	 *       - formmode : view|edit|create
+	 *       - values for parent
+	 * @param bool $bTrustContent if false then won't allow modified TWIG content
 	 *
-	 * @param bool $bTrustContent if false then won't allow TWIG content
+	 * @return \Combodo\iTop\Portal\Form\ObjectFormManager new instance init from JSON data
 	 *
 	 * @inheritDoc
 	 * @throws \Exception
 	 * @throws \SecurityException if twig content is present and $bTrustContent is false
+	 *
+	 * @since 2.7.6 3.0.0 N°4384 new $bTrustContent parameter
 	 */
 	public static function FromJSON($sJson, $bTrustContent = false)
 	{
 		if (is_array($sJson)) {
 			$aJson = $sJson;
 		} else {
 			$aJson = json_decode($sJson, true);
 		}
 
-		if (false === $bTrustContent) {
+		$oConfig = utils::GetConfig();
+		$bIsContentCheckEnabled = $oConfig->GetModuleSetting(PORTAL_ID, 'enable_formmanager_content_check', true);
+		if ($bIsContentCheckEnabled && (false === $bTrustContent)) {
 			/** @noinspection NestedPositiveIfStatementsInspection */
 			if (isset($aJson['formproperties']['layout']['type']) && ($aJson['formproperties']['layout']['type'] === 'twig')) {
 				// There will be an IssueLog above in the hierarchy due to the exception, but we are logging here so that we can output the JSON data !
 				IssueLog::Error('Portal received a query with forbidden twig content!', \LogChannels::PORTAL, ['formmanager_data' => $aJson]);
 				throw new \SecurityException('Twig content not allowed in this context!');
diff --git a/datamodels/2.x/itop-tickets/datamodel.itop-tickets.xml b/datamodels/2.x/itop-tickets/datamodel.itop-tickets.xml
index 9fba410218..9f2c0b0f49 100755
--- a/datamodels/2.x/itop-tickets/datamodel.itop-tickets.xml
+++ b/datamodels/2.x/itop-tickets/datamodel.itop-tickets.xml
@@ -1731,8 +1731,9 @@
     </module_design>
   </module_designs>
   <module_parameters>
     <parameters id="itop-portal" _delta="define">
       <lazy_loading_threshold>500</lazy_loading_threshold><!-- Will be placed in the conf/<env>/config-itop.php file under the itop-portal module's settings  -->
+      <enable_formmanager_content_check type="boolean">true</enable_formmanager_content_check>
     </parameters>
   </module_parameters>
 </itop_design>

Vulnerable code: 	 * Creates an instance of \Combodo\iTop\Portal\Form\ObjectFormManager from JSON data that must contain at least :
	 * - formobject_class : The class of the object that is being edited/viewed
	 * - formmode : view|edit|create
	 * - values for parent
	 * @param bool $bTrustContent if false then won't allow TWIG content
		if (false === $bTrustContent) {
Fixed code: 	 * @param string $sJson JSON data that must contain at least :
	 *       - formobject_class : The class of the object that is being edited/viewed
	 *       - formmode : view|edit|create
	 *       - values for parent
	 * @param bool $bTrustContent if false then won't allow modified TWIG content
	 * @return \Combodo\iTop\Portal\Form\ObjectFormManager new instance init from JSON data
	 *
	 * @since 2.7.6 3.0.0 N°4384 new $bTrustContent parameter
		$oConfig = utils::GetConfig();
		$bIsContentCheckEnabled = $oConfig->GetModuleSetting(PORTAL_ID, 'enable_formmanager_content_check', true);
		if ($bIsContentCheckEnabled && (false === $bTrustContent)) {
      <enable_formmanager_content_check type="boolean">true</enable_formmanager_content_check>