CVE-2022-2636 (Other, published 2022-08-05T10:15Z)
Description: value: Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.


Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
CHANGELOG.md
README.md
bin/v-add-user
bin/v-add-web-domain-redirect
install/hst-install-debian.sh
install/hst-install-ubuntu.sh
install/upgrade/versions/1.6.7.sh
src/deb/hestia/control
Commit message: Fix security issues in v-add-web-domain-redirect + Sync up main with release (#2814)

* Fix v-add-web-domain-redirect

* Remove sudo permission admin group on new setups

We delete the group before install anyway

* Block "sudo" from

* Add missing slash

* Update changelog

* Update versions

Vulnerable code:
- Fix vulnerability in Docuwiki Quick Install App @redstarp2 (CVE 2022-xxx-xxx)
**Latest stable release:** Version 1.6.5 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp) <br>
 "ddl", "ddl_recovery", "performance"); if(in_array(strtolower($argv[1]), $reserved_names, true)){echo implode(", ", $reserved_names);}' "$user" );
scheme=0
    regex='(https?|ftp|file)://[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]'
    if ! [[ "$3" =~ $regex ]]; then
        echo "Invalid redirect"
        exit 2;
    regex='[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]'
    if ! [[ "$3" =~ $regex ]]; then
        echo "Invalid redirect"
        exit 2;
fi
HESTIA_INSTALL_VER='1.6.6~alpha'
HESTIA_INSTALL_VER='1.6.6~alpha'
Version: 1.6.6~alpha

Fixed code:
## [1.6.6] - Service release 

### Bugfixes

- Update DNS templates with CNAME for ftp, www and webmail (#2808)
- Fix name server A record validation error (#2807)
- Fixed issue with renaming domains and config files not properly removed (#2803)
- Add loading indicator after clicking save button (#2740)
- Improve hostname detection in mail-wrapper (#2805 @clarkchentw)

### Security

- Fixed an vulnerability in v-add-web-domain-redirect (CVE-2022-2636)
- Fixed an vulnerability in Ubuntu that can lead in privilege escalation for admin to root user (CVE-2022-2626)

### Dependencies

- Update Roundcube to 1.6.0
- Update Dokuwiki to "2022-07-31" Igor (#2811)

- Fix vulnerability in Docuwiki Quick Install App @redstarp2 (CVE-2022-2550)
**Latest stable release:** Version 1.6.6 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp) <br>
    # sudo has been added due to Privilege escalation as sudo group has always sudo permission
 "ddl", "ddl_recovery", "performance", "sudo"); if(in_array(strtolower($argv[1]), $reserved_names, true)){echo implode(", ", $reserved_names);}' "$user" );
    isValidUrl=$(php -r '$url=$argv[1]; $url=filter_var($url,FILTER_VALIDATE_URL); echo $url;' "$3")
    if  [ -z "$isValidUrl" ]; then
        check_result $E_INVALID "Invalid redirect"
    isValidUrl=$(php -r '$url=$argv[1]; $url=filter_var($url,FILTER_VALIDATE_URL); echo $url;' "http://$3")
    if  [ -z "$isValidUrl" ]; then
        check_result $E_INVALID "Invalid redirect"
fi 
HESTIA_INSTALL_VER='1.6.7~alpha'
HESTIA_INSTALL_VER='1.6.7~alpha'
# Remove sudo "default" sudo permission admin user group should not exists any way 
sed -i "s/%admin ALL=(ALL) ALL/#%admin ALL=(ALL) ALL/g" /etc/sudoers
#!/bin/bash

# Hestia Control Panel upgrade script for target version 1.6.7

#######################################################################################
#######                      Place additional commands below.                   #######
#######################################################################################
####### Pass through information to the end user in case of a issue or problem  #######
#######                                                                         #######
####### Use add_upgrade_message "My message here" to include a message          #######
####### in the upgrade notification email. Example:                             #######
#######                                                                         #######
####### add_upgrade_message "My message here"                                   #######
#######                                                                         #######
####### You can use \n within the string to create new lines.                   #######
#######################################################################################

upgrade_config_set_value 'UPGRADE_UPDATE_WEB_TEMPLATES' 'no'
upgrade_config_set_value 'UPGRADE_UPDATE_DNS_TEMPLATES' 'no'
upgrade_config_set_value 'UPGRADE_UPDATE_MAIL_TEMPLATES' 'no'
upgrade_config_set_value 'UPGRADE_REBUILD_USERS' 'no'
upgrade_config_set_value 'UPGRADE_UPDATE_FILEMANAGER_CONFIG' 'false'
Version: 1.6.7~alpha