CVE-2016-6189 (Objective-C, published 2017-02-17T17:59Z)
Description: value: Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-184 \u2014 Incomplete List of Disallowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.
Repository: https://github.com/inverse-inc/sogo
Files changed:
SoObjects/Appointments/SOGoCalendarComponent.m
SoObjects/SOGo/SOGoUserSettings.h
SoObjects/SOGo/SOGoUserSettings.m
Commit message: (fix) improved previous commit for attributes stripping and UID generation (fixes #3695 and #3696)


Vulnerable code:
  NSString *type, *summary, *tag;
  NSArray *children;
  int classification, i;
  [component setSummary: summary];
  [component setComment: @""];
  [component setUserComment: @""];
  [component setLocation: @""];
  [component setCategories: [NSArray array]];
  [component setUrl: @""];
  [component setOrganizer: nil];
  [component removeAllAttendees];
  [component removeAllAlarms];

  // We strip all X- tags
  children = [component children];

  for (i = 0; i < [children count]; i++)
      tag = [[children objectAtIndex: i] tag];
      if ([[tag uppercaseString] hasPrefix: @"X-"])
        [component removeChild: [children objectAtIndex: i]];
 * Copyright (C) 2009-2014 Inverse inc.
 * Copyright (C) 2009-2014 Inverse inc.

Fixed code:
#import <SOGo/NSString+Crypto.h>
#import <SOGo/SOGoUserSettings.h>
  NSString *type, *summary, *tag, *uid;
  SOGoUserSettings *settings;
  SOGoUser *calendarOwner;
  NSEnumerator *children;
  CardElement *element;
  NSArray *tags;
  int classification;
  calendarOwner = [SOGoUser userWithLogin: [self ownerInContext: context]];
  settings = [calendarOwner userSettings];


  tags = [NSArray arrayWithObjects: @"DTSTAMP", @"DTSTART", @"DTEND", @"DUE", @"EXDATE", @"EXRULE", @"RRULE", nil];
  uid = [[component uid] asCryptedPassUsingScheme: @"ssha256"
                                         withSalt: [[settings userSalt] dataUsingEncoding: NSASCIIStringEncoding]
                                      andEncoding: encHex];

  children = [[[[component children] copy] autorelease] objectEnumerator];

  while ((element = [children nextObject]))
      tag = [element tag];
      if (![tags containsObject: [tag uppercaseString]])
        [component removeChild: element];

  [component setSummary: summary];
  [component setUid: uid];
 * Copyright (C) 2009-2016 Inverse inc.
- (NSString *) userSalt;
 * Copyright (C) 2009-2016 Inverse inc.
#import <Foundation/NSProcessInfo.h>
#import "NSString+Crypto.h"
- (NSString *) userSalt
{
  NSMutableDictionary *values;
  NSString *salt;

  salt = [[self dictionaryForKey: @"General"] objectForKey: @"Salt"];

  if (!salt)
    {
      salt = [[[NSProcessInfo processInfo] globallyUniqueString] asSHA1String];
      values = [self objectForKey: @"General"];

      if (!values)
        values = [NSMutableDictionary dictionary];

      [values setObject: salt  forKey: @"Salt"];
      [self setObject:  values forKey: @"General"];
      [self synchronize];
    }

  return salt;
}