CVE-2018-6010 (PHP, published 2018-01-22T22:29Z)
Description: value: In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/yiisoft/yii2
Files changed:
framework/CHANGELOG.md
framework/base/ErrorHandler.php
framework/log/Dispatcher.php
framework/views/errorHandler/exception.php
tests/framework/log/DispatcherTest.php
Commit message: Fixes #14711: Fixed `yii\web\ErrorHandler` displaying exception message in non-debug mode



Vulnerable code:
        if ($exception instanceof Exception && ($exception instanceof UserException || !YII_DEBUG)) {
            $message = "{$exception->getName()}: {$exception->getMessage()}";
        } elseif (YII_DEBUG) {
            if ($exception instanceof Exception) {
                $message = "Exception ({$exception->getName()})";
            } elseif ($exception instanceof ErrorException) {
                $message = "{$exception->getName()}";
            } else {
                $message = 'Exception';
            }
            $message .= " '" . get_class($exception) . "' with message '{$exception->getMessage()}' \n\nin "
                . $exception->getFile() . ':' . $exception->getLine() . "\n\n"
                . "Stack trace:\n" . $exception->getTraceAsString();
            $message = 'Error: ' . $exception->getMessage();
                        'Unable to send log via ' . get_class($target) . ': ' . ErrorHandler::convertExceptionToString($e),
            $name = $handler->getExceptionName($exception);
                        [[
                            'Unable to send log via ' . get_class($target1) . ': Exception: some error',
                            Logger::LEVEL_WARNING,
                            'yii\log\Dispatcher::dispatch',
                            'time data',
                            [],
                        ]],

Fixed code:
- Bug #14711: Fixed `yii\web\ErrorHandler` displaying exception message in non-debug mode (samdark)
        if ($exception instanceof UserException) {
            return "{$exception->getName()}: {$exception->getMessage()}";
        }

        if (YII_DEBUG) {
            return static::convertExceptionToVerboseString($exception);
        }

        return 'An internal server error occurred.';
    }

    /**
     * Converts an exception into a string that has verbose information about the exception and its trace.
     * @param \Exception|\Error $exception the exception being converted
     * @return string the string representation of the exception.
     *
     * @since 2.0.14
     */
    public static function convertExceptionToVerboseString($exception)
    {
        if ($exception instanceof Exception) {
            $message = "Exception ({$exception->getName()})";
        } elseif ($exception instanceof ErrorException) {
            $message = "{$exception->getName()}";
            $message = 'Exception';
        $message .= " '" . get_class($exception) . "' with message '{$exception->getMessage()}' \n\nin "
            . $exception->getFile() . ':' . $exception->getLine() . "\n\n"
            . "Stack trace:\n" . $exception->getTraceAsString();
                        'Unable to send log via ' . get_class($target) . ': ' . ErrorHandler::convertExceptionToVerboseString($e),
                        $this->callback(function($arg) use ($target1) {
                            if (!isset($arg[0][0], $arg[0][1], $arg[0][2], $arg[0][3])) {
                                return false;
                            }

                            if (strpos($arg[0][0], 'Unable to send log via ' . get_class($target1) . ': Exception (Exception) \'yii\base\UserException\' with message \'some error\'') !== 0) {
                                return false;
                            }

                            if ($arg[0][1] !== Logger::LEVEL_WARNING) {
                                return false;
                            }

                            if ($arg[0][2] !== 'yii\log\Dispatcher::dispatch') {
                                return false;
                            }

                            if ($arg[0][3] !== 'time data') {
                                return false;
                            }

                            if ($arg[0][4] !== []) {
                                return false;
                            }

                            return true;
                        }),