CVE-2023-0671 (PHP, published 2023-02-04T01:15Z)
Description: value: Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/froxlor/froxlor
Files changed:
lib/Froxlor/Api/Commands/DirOptions.php
lib/Froxlor/FileDir.php
lng/de.lng.php
lng/en.lng.php
tests/Extras/DirOptionsTest.php
Commit message: fix possible privilege escalation from customer to root when specifying custom error documents in directory-options

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>


Vulnerable code:
	 * @param
	 *            string error-document-string
	private function correctErrorDocument($errdoc = null, $throw_exception = false)
		if ($errdoc !== null && $errdoc != '') {
				} else {
					} elseif (substr($errdoc, -1) != '"') {
						$errdoc .= '"';
		return $errdoc;
		// check for bad characters, some are allowed with escaping
		// thx to aaronmueller for this snipped
			"\0"
	 * 

Fixed code:
	 * @param string $errdoc
	private function correctErrorDocument(string $errdoc, $throw_exception = false)
		if (trim($errdoc) != '') {
				} elseif (preg_match('/^"([^\r\n\t\f\0"]+)"$/', $errdoc)) {
				} else {
					Response::standardError('invaliderrordocumentvalue', '', $throw_exception);
		return trim($errdoc);
		// check for bad characters, some are allowed with escaping,
		// thx to aaronmueller for this snippet
			"\0",
			"\n",
			"\r",
			"\t",
			"\f"
	 *
		'invaliderrordocumentvalue' => 'Der angegebene Wert für das Fehlederdokument ist keine gültige Datei, URL oder Text-Zeile.',
		'invaliderrordocumentvalue' => 'The value given as ErrorDocument does not seem to be a valid file, URL or string.',

	public function testCustomerDirOptionsAddMalformed()
	{
		global $admin_userdata;

		// get customer
		$json_result = Customers::getLocal($admin_userdata, array(
			'loginname' => 'test1'
		))->get();
		$customer_userdata = json_decode($json_result, true)['data'];

		$data = [
			'path' => '/testmalformed',
			'error404path' => '/"'.PHP_EOL.'something/../../../../weird 404.html'.PHP_EOL.'#'
		];
		$json_result = DirOptions::getLocal($customer_userdata, $data)->add();
		$result = json_decode($json_result, true)['data'];
		$expected = '/"something/././././weird\ 404.html#';
		$this->assertEquals($expected, $result['error404path']);
	}

	public function testCustomerDirOptionsAddMalformedInvalid()
	{
		global $admin_userdata;

		// get customer
		$json_result = Customers::getLocal($admin_userdata, array(
			'loginname' => 'test1'
		))->get();
		$customer_userdata = json_decode($json_result, true)['data'];

		$data = [
			'path' => '/testmalformed',
			'error404path' => '"'.PHP_EOL.'IncludeOptional /something/else/'.PHP_EOL.'#'
		];
		$this->expectExceptionMessage("The value given as ErrorDocument does not seem to be a valid file, URL or string.");
		DirOptions::getLocal($customer_userdata, $data)->add();

		$data = [
			'path' => '/testmalformed',
			'error404path' => '"something"oh no a quote within the string"'
		];
		$this->expectExceptionMessage("The value given as ErrorDocument does not seem to be a valid file, URL or string.");
		DirOptions::getLocal($customer_userdata, $data)->add();
	}