CVE-2022-27157 (PHP, published 2022-04-15T18:15Z)
Description: value: pearweb < 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-640 \u2014 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Repository: https://github.com/pear/pearweb
Files changed:
include/bugs/pear-bug-accountrequest.php
include/pear-database-user.php
include/pepr/pepr-ppvote.php
include/users/passwordmanage.php
pearweb.php
pearweb_election.php
pearweb_pepr.php
public_html/admin/index.php
rollback.php
scripts/rollbackProposal.php
Commit message: Be cautious about what can be unserialized


Vulnerable code:
        @$arr = unserialize($user['userinfo']);
        @$arr = unserialize($user['userinfo']);
        $set['reviews'] = unserialize($set['reviews']);
            $set['reviews'] = unserialize($set['reviews']);
        $salt = md5(mt_rand(4,13) . $user . time() . $pass1);
}
            $curdef = unserialize(file_get_contents($updir .
              $answers['database'] . '-' . $oldversion . '.ser'));
}
            $curdef = unserialize(file_get_contents('@www-dir@/sql/.pearweb-upgrade/' .
              $answers['database'] . '-' . $oldversion . '.ser'));
}
            $curdef = unserialize(file_get_contents('@www-dir@/sql/.pearweb-upgrade/' .
              $answers['database'] . '-' . $oldversion . '.ser'));
}
        list($purpose, $moreinfo) = @unserialize($requser['userinfo']);
            if (@unserialize($userinfo)) {
                $userinfo = @unserialize($userinfo);
            $comment .= "Reviewed: " . implode(", ", unserialize($row->reviews));
            $comment .= "Reviewed: " . implode(", ", unserialize($row->reviews));

Fixed code:
        try {
            @$arr = unserialize($user['userinfo'], ['allowed_classes' => false]);
        } catch (Exception $ex) {
            $arr = false;
        }
        try {
            @$arr = unserialize($user['userinfo'], ['allowed_classes' => false]);
        } catch (Exception $ex) {
            $arr = false;
        }
        try {
            $unserialised = unserialize($set['reviews'], ['allowed_classes' => false]);
            if ($unserialised !== false) {
                $set['reviews'] = $unserialised;
            }
        } catch (Exception $ex) {
            $set['reviews'] = array();
        }
            $uReviews = unserialize($set['reviews'], ['allowed_classes' => false]);
            if ($uReviews !== false) {
                $set['reviews'] = $uReviews;
            }
        $random_bytes = openssl_random_pseudo_bytes(16, $strong);
        if ($random_bytes === false || $strong === false) {
            $errors[] = "Could not generate a safe password token";
            return $errors;
        }
        $salt = md5($rand_bytes);
}
            $sFile = $updir . $answers['database'] . '-' . $oldversion . '.ser';
            try {
                $curdef = unserialize(file_get_contents($sFile), ['allowed_classes' => false]);
            } catch (Exception $ex) {
                $curdef = false;
            }

}
            $sFile = '@www-dir@/sql/.pearweb-upgrade/' . $answers['database'] . '-' . $oldversion . '.ser';
            try {
                $curdef = unserialize(file_get_contents($sFile), ['allowed_classes' => false]);
            } catch (Exception $ex) {
                $curdef = false;
            }
}
            try {
                $sFile = '@www-dir@/sql/.pearweb-upgrade/' . $answers['database'] . '-' . $oldversion . '.ser';
                $curdef = unserialize(file_get_contents($sFile), ['allowed_classes' => false]);
            } catch (Exception $ex) {
                $curdef = false;
            }
}
        try {
            $uInfo = @unserialize($requser['userinfo'], ['allowed_classes' => false]);
            if ($uInfo !== false) {
                list($purpose, $moreinfo) = $uInfo;
            }
        } catch (Exception $ex) {
            $purpose = 'n/a';
            $moreinfo = 'n/a';
        }
            if (@unserialize($userinfo, ['allowed_classes' => false])) {
                $userinfo = @unserialize($userinfo, ['allowed_classes' => false]);
            $reviewed = "Reviewed: n/a";
            try {
                $uInfo = unserialize($row->reviews, ['allowed_classes' => false]);
                if ($uInfo !== false) {
                    $reviewed = "Reviewed: " . implode(", ", $uInfo);
                }
            } catch (Exception $ex) {
                // do nothing
            }
            $comment .= $reviewed;
            $reviewed = "Reviewed: n/a";
            try {
                $uInfo = unserialize($row->reviews, ['allowed_classes' => false]);
                if ($uInfo !== false) {
                    $reviewed = "Reviewed: " . implode(", ", $uInfo);
                }
            } catch (Exception $ex) {
                // do nothing
            }
            $comment .= $reviewed;