CVE-2020-36642: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is able to address this issue. The identifier of the patch is 8f43daf50c943b98eaf0c542da901a4a16e85b02. It is recommended to upgrade the affected component. The identifier VDB-217553 was assigned to this vulnerability.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-01-06T11:15Z
Repository: https://github.com/trampgeek/jobe
Language: PHP
Files changed: application/libraries/LanguageTask.php
Commit date: 2020-11-20 14:39:27 +1300
Commit message: Prevent command injection attacks via the cputime parameter. Fixes
issue #39 (https://github.com/trampgeek/jobe/issues/39).
Thanks Marlon (myxxl).

Diff: diff --git a/application/libraries/LanguageTask.php b/application/libraries/LanguageTask.php
index 25cbd7e..4df14f4 100644
--- a/application/libraries/LanguageTask.php
+++ b/application/libraries/LanguageTask.php
@@ -322,21 +322,29 @@ abstract class Task {
     }
 
 
     /*
      * Get the value of the job parameter $key, which is taken from the
-     * value copied into $this from the run request if present of from the
+     * value copied into $this from the run request if present or from the
      * system defaults otherwise.
+     * If a non-numeric value is provided for a parameter that has a numeric
+     * default, the default is used instead. This prevents command injection
+     * as per issue #39 (https://github.com/trampgeek/jobe/issues/39). Thanks
+     * Marlon (myxl).
      * If $iscompile is true and the parameter value is less than that specified
      * in $min_params_compile (except if it's 0 meaning no limit), the minimum
      * value is used instead.
      */
     protected function getParam($key, $iscompile=false) {
+        $default = $this->default_params[$key];
         if (isset($this->params) && array_key_exists($key, $this->params)) {
             $param = $this->params[$key];
+            if (is_numeric($default) && !is_numeric($param)) {
+                $param = $default; // Prevent command injection attacks.
+            }
         } else {
-            $param = $this->default_params[$key];
+            $param = $default;
         }
         // ** BUG ** The min_params_compile value is being applied even if
         // this is not a compile. I'm reluctant to fix, however, as it may
         // break existing questions with inappropriately low resource settings.
         if ($param != 0 && array_key_exists($key, $this->min_params_compile) &&
@@ -345,10 +353,11 @@ abstract class Task {
         }
         return $param;
     }
 
 
+    
     // Check if PHP exec environment includes a PATH. If not, set up a
     // default, or gcc misbehaves. [Thanks to Binoj D for this bug fix,
     // needed on his CentOS system.]
     protected function setPath() {
         $envVars = array();

Vulnerable code:      * value copied into $this from the run request if present of from the
            $param = $this->default_params[$key];
Fixed code:      * value copied into $this from the run request if present or from the
     * If a non-numeric value is provided for a parameter that has a numeric
     * default, the default is used instead. This prevents command injection
     * as per issue #39 (https://github.com/trampgeek/jobe/issues/39). Thanks
     * Marlon (myxl).
        $default = $this->default_params[$key];
            if (is_numeric($default) && !is_numeric($param)) {
                $param = $default; // Prevent command injection attacks.
            }
            $param = $default;