CVE-2018-13982 (PHP, published 2018-09-18T21:29Z)
Description: value: Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/smarty-php/smarty
Files changed:
change_log.txt
libs/Smarty.class.php
libs/sysplugins/smarty_security.php
Commit message: - bugfix  regarding Security Vulnerability did not solve the problem under Linux


Vulnerable code:
﻿===== 3.1.32 ===== (24.04.2018)
 * @version   3.1.32
    const SMARTY_VERSION = '3.1.32';
                $this->plugins_dir[ $k ] = $this->_realpath(rtrim($v, "/\\") . DIRECTORY_SEPARATOR, true);
        static $sepDotsep = null;
        static $sepDot = null;
        static $sepSep =null;
            $sepDotsep = DIRECTORY_SEPARATOR . '.' . DIRECTORY_SEPARATOR;
            $sepDot = DIRECTORY_SEPARATOR . '.';
        $path = str_replace(array($nds[DIRECTORY_SEPARATOR], $sepDotsep), DIRECTORY_SEPARATOR, $path);
        if (strpos($path,$sepDot) === false && (($realpath === false && $path[0] === '.') || $realpath === null) && $path[0] !== '\\') {
            return $path;
        }
        $path = str_replace(array($sepDotsep,$sepSep), DIRECTORY_SEPARATOR, $path);
        $this->smarty->_cache[ 'template_dir_new' ] = true;
        $this->smarty->_cache[ 'config_dir_new' ] = true;
        if ($isConfig !== true) {
        }
        if ($isConfig !== false) {
        }
                $this->secure_dir[$k] = $this->smarty->_realpath($d.DIRECTORY_SEPARATOR,true);
                $directory = $this->smarty->_realpath($directory . DIRECTORY_SEPARATOR, true);
            $directory = $this->smarty->_realpath($directory, true);
            $directory = $this->smarty->_realpath($directory, true);
        $directory = dirname($filepath) . DIRECTORY_SEPARATOR;
        if (isset($dirs[ $directory ])) {
            return false;
        }
        $filepath = $this->smarty->_realpath($filepath, true);
        $directory = dirname($filepath) . DIRECTORY_SEPARATOR;
            if (!preg_match('#[\\\/][^\\\/]+[\\\/]$#', $directory)) {
                break;
            $directory = preg_replace('#[\\\/][^\\\/]+[\\\/]$#', DIRECTORY_SEPARATOR, $directory);

        // give up
        throw new SmartyException("directory '{$filepath}' not allowed by security setting");

Fixed code:
﻿===== 3.1.33-dev-1 =====
26.04.2018
 - bugfix  regarding Security Vulnerability did not solve the problem under Linux.

===== 3.1.32 ===== (24.04.2018)
 * @version   3.1.33-dev
    const SMARTY_VERSION = '3.1.33-dev-1';
                $this->plugins_dir[ $k ] = $this->_realpath(rtrim($v, '/\\') . DIRECTORY_SEPARATOR, true);
        static $sepDotSep = null;
         static $sepSep =null;
            $sepDotSep = DIRECTORY_SEPARATOR . '.' . DIRECTORY_SEPARATOR;
        $path = str_replace(array($nds[DIRECTORY_SEPARATOR], $sepDotSep), DIRECTORY_SEPARATOR, $path);
        $path = str_replace(array($sepDotSep,$sepSep), DIRECTORY_SEPARATOR, $path);



                $this->secure_dir[$k] = $this->smarty->_realpath($d. DIRECTORY_SEPARATOR,true);
                $directory = $this->smarty->_realpath($directory . '/', true);
 //           $directory = $this->smarty->_realpath($directory, true);
 //           $directory = $this->smarty->_realpath($directory, true);
        $directory = dirname($this->smarty->_realpath($filepath, true)) . DIRECTORY_SEPARATOR;
            if (!preg_match('#[\\\\/][^\\\\/]+[\\\\/]$#', $directory)) {
                // give up
                throw new SmartyException(sprintf('Smarty Security: not trusted file path \'%s\' ',$filepath));
            $directory = preg_replace('#[\\\\/][^\\\\/]+[\\\\/]$#', '/', $directory);