CVE-2022-0196 (PHP, published 2022-01-13T01:15Z)
Description: value: phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/phoronix-test-suite/phoronix-test-suite
Files changed:
pts-core/objects/pts_strings.php
pts-core/phoromatic/pages/phoromatic_local_suites.php
pts-core/phoromatic/pages/phoromatic_schedules.php
pts-core/phoromatic/pages/phoromatic_users.php
pts-core/phoromatic/pages/phoromatic_welcome.php
pts-core/phoromatic/phoromatic_functions.php
pts-core/phoromatic/public_html/event.php
pts-core/pts-core.php
Commit message: phoromatic: Some additional input sanitization and starting on some CSRF token handling


Vulnerable code:
		return empty($str) ? '' : pts_strings::keep_in_string($input, pts_strings::CHAR_LETTER | pts_strings::CHAR_NUMERIC | pts_strings::CHAR_DASH | pts_strings::CHAR_DECIMAL | pts_strings::CHAR_SPACE | pts_strings::CHAR_UNDERSCORE | pts_strings::CHAR_COMMA | pts_strings::CHAR_AT | pts_strings::CHAR_COLON);
		if(!PHOROMATIC_USER_IS_VIEWER && isset($PATH[0]) && $PATH[0] == 'delete')
				$main .= '<p><a href="?build_suite/' . $id . '">Edit Suite</a> - <a href="?local_suites/delete/' . $id . '">Delete Suite</a></p>';
						$trigger = base64_decode($PATH[2]);
					else if(isset($PATH[1]) && in_array($PATH[1], array('activate', 'deactivate')))
						$main .= '<a href="?schedules/' . $PATH[0] . '/deactivate">Deactivate Schedule</a>';
						$main .= '<a href="?schedules/' . $PATH[0] . '/activate">Activate Schedule</a>';
		if(isset($_POST['group_name']))
		$main .= '<hr /><form action="' . $_SERVER['REQUEST_URI'] . '" name="group_name" id="group_name" method="post"><h2>Group Name</h2>
		$stmt->bindValue(':trigger', $_GET['trigger']);
			echo 'Trigger ' . htmlspecialchars($_GET['trigger']) . ' added!';
pts_define('PTS_CORE_VERSION', 10800);

Fixed code:
		return empty($input) ? '' : pts_strings::keep_in_string($input, pts_strings::CHAR_LETTER | pts_strings::CHAR_NUMERIC | pts_strings::CHAR_DASH | pts_strings::CHAR_DECIMAL | pts_strings::CHAR_SPACE | pts_strings::CHAR_UNDERSCORE | pts_strings::CHAR_COMMA | pts_strings::CHAR_AT | pts_strings::CHAR_COLON);
		if(!PHOROMATIC_USER_IS_VIEWER && isset($PATH[0]) && $PATH[0] == 'delete' && verify_submission_token())
				$main .= '<p><a href="?build_suite/' . $id . '">Edit Suite</a> - <a href="?local_suites/delete/' . $id . append_token_to_url() . '">Delete Suite</a></p>';
						$trigger = pts_strings::sanitize(base64_decode($PATH[2]));
					else if(isset($PATH[1]) && in_array($PATH[1], array('activate', 'deactivate')) && verify_submission_token())
						$main .= '<a href="?schedules/' . $PATH[0] . '/deactivate' . append_token_to_url()  . '">Deactivate Schedule</a>';
						$main .= '<a href="?schedules/' . $PATH[0] . '/activate' . append_token_to_url()  . '">Activate Schedule</a>';
		if(isset($_POST['group_name']) && verify_submission_token())
		$main .= '<hr /><form action="' . $_SERVER['REQUEST_URI'] . '" name="group_name" id="group_name" method="post"><h2>Group Name</h2>' . write_token_in_form() . '
					$_SESSION['Token'] = sha1($account_salt . (function_exists('random_bytes') ? bin2hex(random_bytes(32)) : rand()) . PTS_CORE_VERSION . time());
function write_token_in_form()
{
	return '<input type="hidden" name="token_submit" value="' . $_SESSION['Token'] . '" />';
}
function append_token_to_url()
{
	return '/&token_submit=' . $_SESSION['Token'];
}
function verify_submission_token()
{
	return isset($_REQUEST['token_submit']) && $_REQUEST['token_submit'] == $_SESSION['Token'];
}
		$trigger = pts_strings::sanitize($_GET['trigger']);
		$stmt->bindValue(':trigger', $trigger);
			echo 'Trigger ' . $trigger . ' added!';
pts_define('PTS_CORE_VERSION', 10801);