CVE-2022-0848: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-03-04T09:15Z
Repository: https://github.com/part-db/part-db
Language: PHP
Files changed: inc/lib.php
Commit date: 2022-03-02 00:36:31 +0100
Commit message: Disallow uploading of potentially unsafe file extensions.


Diff: diff --git a/inc/lib.php b/inc/lib.php
index f7894968..4b6d6c98 100644
--- a/inc/lib.php
+++ b/inc/lib.php
@@ -247,10 +247,22 @@ function sendString($content, $filename, $mimetype)
 
     echo $content;
     exit;
 }
 
+/**
+ * Gets the file extension from a filename
+ *
+ * @param string    $filename The filename
+ * @return string The extension of the file
+ */
+function getExtensionFromFileName($filename)
+{
+    $tmp = explode('.', $filename);
+    return end($tmp);
+}
+
 /**
  * Upload a file (from "<input type="file">) to a directory on the server
  *
  * @param array         $file_array                 The file array, for example $_FILES['my_file']
  * @param string        $destination_directory      The directory where the file should be saved.
@@ -264,17 +276,19 @@ function sendString($content, $filename, $mimetype)
  * @throws Exception if the destination file exists already
  * @throws Exception if there was an error
  */
 function uploadFile($file_array, $destination_directory, $destination_filename = null)
 {
+    $unsafe_extensions = ['php', 'phtml', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5', 'phtm', 'sh', 'asp', 'cgi', 'py', 'pl', 'exe', 'aspx'];
+
     if ((! isset($file_array['name'])) || (! isset($file_array['tmp_name'])) || (! isset($file_array['error']))) {
         throw new Exception(_('Ungültiges Array übergeben!'));
     }
 
-    //Dont allow to upload a PHP file.
-    if(strpos($file_array['name'], ".php") != false
-        || strpos($destination_filename, ".php") != false)
+    //Dont allow upload of files with potentially dangerous extension
+    if (in_array(getExtensionFromFileName($file_array['name']), $unsafe_extensions)
+        || in_array(getExtensionFromFileName($destination_filename), $unsafe_extensions))
     {
         throw new \Exception(_("Es ist nicht erlaubt PHP Dateien hochzuladen!"));
     }
 
     if ($destination_filename == null) {

Vulnerable code:     //Dont allow to upload a PHP file.
    if(strpos($file_array['name'], ".php") != false
        || strpos($destination_filename, ".php") != false)
Fixed code: /**
 * Gets the file extension from a filename
 *
 * @param string    $filename The filename
 * @return string The extension of the file
 */
function getExtensionFromFileName($filename)
{
    $tmp = explode('.', $filename);
    return end($tmp);
}

    $unsafe_extensions = ['php', 'phtml', 'php3', 'ph3', 'php4', 'ph4', 'php5', 'ph5', 'phtm', 'sh', 'asp', 'cgi', 'py', 'pl', 'exe', 'aspx'];

    //Dont allow upload of files with potentially dangerous extension
    if (in_array(getExtensionFromFileName($file_array['name']), $unsafe_extensions)
        || in_array(getExtensionFromFileName($destination_filename), $unsafe_extensions))