CVE-2021-44663 (Other, published 2022-02-24T19:15Z)
Description: value: A Remote Code Execution (RCE) vulnerability exists in the Xerte Project Xerte through 3.8.4 via a crafted php file through elfinder in connetor.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/thexerteproject/xerteonlinetoolkits
Files changed:
USER-FILES/.htaccess
editor/elfinder/browse.php
editor/elfinder/php/connector.php
editor/elfinder/php/elFinderVolumeDriver.class.php
editor/elfinder/php/mime.types
error_logs/.htaccess
import/.htaccess
languages/.htaccess
modules/decision/templates/decision/.htaccess
modules/site/templates/site/.htaccess
modules/xerte/templates/FutureTeacher/.htaccess
modules/xerte/templates/Nottingham/.htaccess
modules/xerte/templates/Rss/.htaccess
modules/xerte/templates/mediaInteractions/.htaccess
modules/xerte/templates/multipersp/.htaccess
plugins/file_uploading-extension-check.php
print/index.php
print/print.php
setup/htaccess.conf
website_code/php/import/fileupload.php
website_code/php/management/upload.php
Commit message: Security patch - Thank you Rik Lutz

 - Fixed and stopped possibility to upload constructed php files throgh
   elfinder
 - Added .htaccess files to try to tighten security on apache servers
 - Always use extension blacklist (ignore management page setting)
 - Stop XSS in print
 - Several other small improvements


Vulnerable code:
#RemoveHandler .php
<FilesMatch "\.((php[0-9]?)|p?html?|pl|sh|java|cpp|c|h|js|rc)$">
    SetHandler None
</FilesMatch>
                url : 'php/connector.php?uploadDir=<?php echo $_REQUEST['uploadDir'];?>&uploadURL=<?php echo $_REQUEST['uploadURL'];?>',       // connector URL (REQUIRED)
            'tmbPath'       => $rootpath . "/media//.tmb",
            'uploadDeny' => array('text/x-php'),
application/x-php php php3 php4
if (Xerte_Validate_FileExtension::canRun() && $xerte_toolkits_site->enable_file_ext_check) {
        <label>Link to LO:
          <input name="link" type="text" id="link" value="http://training.mitchellmedia.co.uk/xerte/play.php?template_id=96" size="100" />
    <h1><?php 
	$link=$_GET["link"];
	
Options +FollowSymLinks

Fixed code:
#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
require_once "../../config.php";

if(empty($_SESSION['toolkits_logon_id'])) {
    die("Please login");
}

// if there are GET paramters, put them in session and restart
if (isset($_GET['uploadDir']) && isset($_GET['uploadURL']))
{
    $_SESSION['uploadDir'] = $_REQUEST['uploadDir'];
    $_SESSION['uploadURL'] = $_REQUEST['uploadURL'];

    $params = "?";
    foreach($_GET as $key => $param)
    {
        if ($key != "uploadDir" && $key != "uploadURL")
        {
            if (strlen($params) > 1)
            {
                $params .= "&";
            }
            $params .= $key . "=" . $param;
        }
    }

    header("Location: " . $_SERVER["SCRIPT_NAME"] . $params);
}

if (strpos($_SESSION['uploadDir'], 'USER-FILES') === false || strpos($_SESSION['uploadURL'], 'USER-FILES') === false)
{
    die("Invalid upload location");
}

                url : 'php/connector.php?uploadDir=<?php echo $_SESSION['uploadDir'];?>&uploadURL=<?php echo $_SESSION['uploadURL'];?>',       // connector URL (REQUIRED)
            'tmbPath'       => $rootpath . "/media/.tmb",
            'uploadDeny' => array('text/x-php','application/x-php'),
				if ($ext && strpos($type, "text/plain") === 0)
                {
                    if (isset(elFinderVolumeDriver::$mimetypes[$ext])) $type = elFinderVolumeDriver::$mimetypes[$ext];
                }
application/x-php php php3 php4 php5
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py|log)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
# Stop Apache doing directory indexing.
Options -Indexes 


# Try and tell Apache not to serve out any files within this directory as PHP - 
# this helps close a potential security flaw - given people can upload almost anything into an LO.

#prevent execution of php code (and other code)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .*\.(php|php[0-9]|phtml|pl|sh|java|py)$ - [F]
</IfModule>
// TOR 2020-03-24
// Force extension check, so DO NOT CHECK $xerte_toolkits_site->enable_file_ext_check
//if (Xerte_Validate_FileExtension::canRun() && $xerte_toolkits_site->enable_file_ext_check) {
if (Xerte_Validate_FileExtension::canRun()) {
        <label>The template id of the LO, :
          <input name="template_id" type="text" id="template_id" value="" size="80" />
<?php
require_once("../config.php");
?>
    <p><?php
	$template_id=$_GET["template_id"];

	// Create the link
    $link = $xerte_toolkits_site->site_url . "play.php?template_id=" . $template_id;
Options +FollowSymLinks -Indexes
if (!isset($_SESSION['toolkits_logon_username']))
{
    _debug("Session is invalid or expired");
    die("Session is invalid or expired");
}

if (!isset($_SESSION['toolkits_logon_username']))
{
    _debug("Session is invalid or expired");
    die("Session is invalid or expired");
}