Vulnerability: An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
Vulnerability ID: CVE-2020-12078
CWE: CWE-78
Severity score: 10
Project: https://github.com/Opmantek/open-audit
Published: 2020-04-28
File: code_igniter/application/helpers/discoveries_helper.php
Commit message: Validate correct character for subnet and exclude_ip attributes when running a discovery.
Commit author: Mark Unwin

Vulnerable version (before fix):
 function discover_subnet($queue_item = null) 		$data = array($discovery_id); 		$CI->db->query($sql, $data);  		if ( ! empty($CI->config->config['discovery_ip_exclude'])) { 			// Account for users adding multiple spaces which would be converted to multiple comma's. 			$exclude_ip = preg_replace('!\s+!', ' ', $CI->config->config['discovery_ip_exclude']); function discover_subnet($queue_item = null) 				$discovery->attributes->other->nmap->exclude_ip = $exclude_ip; 			} 		}  		$all_ip_list = all_ip_list($discovery); 

Fixed version (after fix):
 function discover_subnet($queue_item = null) 		$data = array($discovery_id); 		$CI->db->query($sql, $data);  		if ( ! preg_match('/^[\d,\.,\/,\-]*$/', $discovery->attributes->other->subnet)) { 			$log->message = 'Invalid subnet value supplied of ' . htmlentities($discovery->attributes->other->subnet); 			$log->severity = 5; 			discovery_log($log); 			return; 		}  		if ( ! empty($CI->config->config['discovery_ip_exclude'])) { 			// Account for users adding multiple spaces which would be converted to multiple comma's. 			$exclude_ip = preg_replace('!\s+!', ' ', $CI->config->config['discovery_ip_exclude']); function discover_subnet($queue_item = null) 				$discovery->attributes->other->nmap->exclude_ip = $exclude_ip; 			} 		} 		// Ensure we only have valid characters of digit, dot, slash and comma in attribute 		if ( ! preg_match('/^[\d,\.,\/,\-,\,]*$/', $discovery->attributes->other->nmap->exclude_ip)) { 			$discovery->attributes->other->nmap->exclude_ip = ''; 			$log->message = 'Invalid characters supplied in exclude_ip, setting to blank.'; 			$log->severity = 5; 			discovery_log($log); 		}  		$all_ip_list = all_ip_list($discovery); 

Patch:
patch: @@ -272,6 +272,13 @@ function discover_subnet($queue_item = null)
 		$data = array($discovery_id);
 		$CI->db->query($sql, $data);
 
+		if ( ! preg_match('/^[\d,\.,\/,\-]*$/', $discovery->attributes->other->subnet)) {
+			$log->message = 'Invalid subnet value supplied of ' . htmlentities($discovery->attributes->other->subnet);
+			$log->severity = 5;
+			discovery_log($log);
+			return;
+		}
+
 		if ( ! empty($CI->config->config['discovery_ip_exclude'])) {
 			// Account for users adding multiple spaces which would be converted to multiple comma's.
 			$exclude_ip = preg_replace('!\s+!', ' ', $CI->config->config['discovery_ip_exclude']);
@@ -283,6 +290,13 @@ function discover_subnet($queue_item = null)
 				$discovery->attributes->other->nmap->exclude_ip = $exclude_ip;
 			}
 		}
+		// Ensure we only have valid characters of digit, dot, slash and comma in attribute
+		if ( ! preg_match('/^[\d,\.,\/,\-,\,]*$/', $discovery->attributes->other->nmap->exclude_ip)) {
+			$discovery->attributes->other->nmap->exclude_ip = '';
+			$log->message = 'Invalid characters supplied in exclude_ip, setting to blank.';
+			$log->severity = 5;
+			discovery_log($log);
+		}
 
 		$all_ip_list = all_ip_list($discovery);
path: code_igniter/application/helpers/discoveries_helper.php