CVE-2019-5884 (PHP, published 2019-01-10T08:29Z)
Description: value: php/elFinder.class.php in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and safe_mode or open_basedir is not set.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/Studio-42/elFinder
Files changed:
php/elFinder.class.php
Commit message: [php:core:security] fix information leakage vulnerability

elFinder <= 2.1.44 PHP connector has high severity security
vulnerability to  information leakage. This vulnerability is affected on
environments in which the curl extension of PHP is enabled and safe_mode
or open_basedir is not set.

To fix this vulnerability with this commit.

We would like to express our special thanks to Ravindra Rajaram
(ravindra.rajaram@broadcom.com) and Hamsalekha Madiraju
(hamsalekha.madiraju@broadcom.com) who reported this vulnerability.


Vulnerable code:
        $method = (function_exists('curl_exec') && !ini_get('safe_mode') && !ini_get('open_basedir')) ? 'curl_get_contents' : 'fsock_get_contents';
        return $this->$method($url, $timeout, $redirect_max, $ua, $fp);
                        $data = $this->get_remote_contents($url, 30, 5, 'Mozilla/5.0', $fp);
                        // to check connection is aborted
                        elFinder::checkAborted();
                        $_name = preg_replace('~^.*?([^/#?]+)(?:\?.*)?(?:#.*)?$~', '$1', rawurldecode($url));
                        // Check `Content-Disposition` response header
                        if ($data && ($headers = get_headers($url, true)) && !empty($headers['Content-Disposition'])) {
                            if (preg_match('/filename\*=(?:([a-zA-Z0-9_-]+?)\'\')"?([a-z0-9_.~%-]+)"?/i', $headers['Content-Disposition'], $m)) {
                                $_name = rawurldecode($m[2]);
                                if ($m[1] && strtoupper($m[1]) !== 'UTF-8' && function_exists('mb_convert_encoding')) {
                                    $_name = mb_convert_encoding($_name, 'UTF-8', $m[1]);
                            } else if (preg_match('/filename="?([ a-z0-9_.~%-]+)"?/i', $headers['Content-Disposition'], $m)) {
                                $_name = rawurldecode($m[1]);

Fixed code:
        if (preg_match('~^(?:ht|f)tps?://[-_.!\~*\'()a-z0-9;/?:\@&=+\$,%#\*]+~i', $url)) {
            $method = (function_exists('curl_exec') && !ini_get('safe_mode') && !ini_get('open_basedir')) ? 'curl_get_contents' : 'fsock_get_contents';
            return $this->$method($url, $timeout, $redirect_max, $ua, $fp);
        }
        return false;
                        if ($data = $this->get_remote_contents($url, 30, 5, 'Mozilla/5.0', $fp)) {
                            // to check connection is aborted
                            elFinder::checkAborted();
                            $_name = preg_replace('~^.*?([^/#?]+)(?:\?.*)?(?:#.*)?$~', '$1', rawurldecode($url));
                            // Check `Content-Disposition` response header
                            if ($data && ($headers = get_headers($url, true)) && !empty($headers['Content-Disposition'])) {
                                if (preg_match('/filename\*=(?:([a-zA-Z0-9_-]+?)\'\')"?([a-z0-9_.~%-]+)"?/i', $headers['Content-Disposition'], $m)) {
                                    $_name = rawurldecode($m[2]);
                                    if ($m[1] && strtoupper($m[1]) !== 'UTF-8' && function_exists('mb_convert_encoding')) {
                                        $_name = mb_convert_encoding($_name, 'UTF-8', $m[1]);
                                    }
                                } else if (preg_match('/filename="?([ a-z0-9_.~%-]+)"?/i', $headers['Content-Disposition'], $m)) {
                                    $_name = rawurldecode($m[1]);