CVE-2020-15247 (PHP, published 2020-11-23T20:15Z)
Description: value: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to cms.enableSafeMode being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having cms.enableSafeMode enabled, but would be a problem for anyone relying on cms.enableSafeMode to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP. Issue has been patched in Build 469 (v1.0.469) and v1.1.0.
Severity: MEDIUM (CVSS v3 base score: 5.2)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/octobercms/october
Files changed:
modules/cms/classes/Controller.php
modules/system/ServiceProvider.php
modules/system/twig/SecurityPolicy.php
Commit message: Security fixes for v1.0.469

Introduces sandbox policy to block extendable methods allowing arbitrary code execution


Vulnerable code:

Fixed code:
use Twig\Extension\SandboxExtension;
use System\Twig\SecurityPolicy;
        $this->twig->addExtension(new SandboxExtension(new SecurityPolicy, true));
use System\Twig\SecurityPolicy as TwigSecurityPolicy;
use Twig\Extension\SandboxExtension;
            $twig->addExtension(new SandboxExtension(new TwigSecurityPolicy, true));
<?php namespace System\Twig;

use Twig\Markup;
use Twig\Template;
use Twig\Sandbox\SecurityPolicyInterface;
use Twig\Sandbox\SecurityNotAllowedMethodError;
use Twig\Sandbox\SecurityNotAllowedPropertyError;

/**
 * SecurityPolicy globally blocks accessibility of certain methods and properties.
 *
 * @package october\system
 * @author Alexey Bobkov, Samuel Georges
 */
final class SecurityPolicy implements SecurityPolicyInterface
{
    protected $blockedProperties = [];

    protected $blockedMethods = [
        'addDynamicMethod',
        'addDynamicProperty'
    ];

    public function __construct()
    {
        $this->setBlockedMethods($this->blockedMethods);
    }

    public function setBlockedMethods(array $methods)
    {
        foreach ($this->blockedMethods as $i => $m) {
            $this->blockedMethods[$i] = strtr($m, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz');
        }
    }

    public function checkSecurity($tags, $filters, $functions)
    {
    }

    public function checkMethodAllowed($obj, $method)
    {
        if ($obj instanceof Template || $obj instanceof Markup) {
            return;
        }

        $blockedMethod = strtr($method, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz');

        if (in_array($blockedMethod, $this->blockedMethods)) {
            $class = get_class($obj);
            throw new SecurityNotAllowedMethodError(sprintf('Calling "%s" method on a "%s" object is blocked.', $method, $class), $class, $method);
        }
    }

    public function checkPropertyAllowed($obj, $property)
    {
        if (in_array($property, $this->blockedProperties)) {
            $class = get_class($obj);
            throw new SecurityNotAllowedPropertyError(sprintf('Calling "%s" property on a "%s" object is blocked.', $property, $class), $class, $property);
        }
    }
}