CVE-2016-15009 (published 2023-01-05T09:15Z)

A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp of the component Search. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is aee43e5714cd8b697355ec3bf83eefee176d3fc3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217440.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/openacs/bug-tracker
commit_details: repo_url: https://github.com/openacs/bug-tracker
author: Gustaf Neumann 
author_date: 2016-05-25 07:38:02+00:00
msg: - protect against too large bug numbers (causes pg errors)
- don't access @patch.patch_id@ for displayed_object_id, if it does
  not exist (view mode)
- don't perform message key subsitution in user contributed bug description
- add csrf protection for search
repository: repo_url: https://github.com/openacs/bug-tracker
repo_name: openacs/bug-tracker
repo_language: Tcl
owner: openacs
file_changes: filename: nav-bar.adp
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,8 @@
       <form action="@form_search_url@" method="get" name="search">
         <input name="q" type="text" size="15" class="bt_navbar" value="#bug-tracker.Search#" 
           onFocus="javascript:this.value='';">
-        <input name="search_package_id" type="hidden" value="@package_id@">
+          <input name="search_package_id" type="hidden" value="@package_id@">
+          <if @::__csrf_token@ defined><input type="hidden" name="__csrf_token" value="@::__csrf_token;literal@"></if>
           <input type="submit" value="#bug-tracker.Search#" class="bt_navbar_btn">
       </form>
   </if>

programming_language: Shell
filename: one-bug.adp
change_type: ModificationType.MODIFY
diff: @@ -9,7 +9,7 @@
   @param style string (either "feed" or "display" -- default is display)
   @param base_url url to the package (ok for this to be empty if in the package, trailing / expected)
 </contract>
-<h1>Bug @bug.bug_number_display@ - @bug.summary@ [@bug.component_name@]</h1>
+<h1>Bug @bug.bug_number_display@ - @bug.summary;noi18n@ [@bug.component_name@]</h1>
 <p>State: @bug.pretty_state@</p>
 <if @bug.found_in_version_name@ not nil><p>Found in version: @bug.found_in_version_name@</p></if>
 <if @bug.fix_for_version_name@ not nil><p>Fix for version: @bug.fix_for_version_name@</p></if>
@@ -17,4 +17,4 @@
 
 <multiple name="roles"><p>@roles.role_pretty@: <a href="@roles.user_url@">@roles.user_name@</a></p></multiple>
 
-@comments;noquote@
\ No newline at end of file
+@comments;literal@
\ No newline at end of file

programming_language: CoffeeScript
filename: bug.tcl
change_type: ModificationType.MODIFY
diff: @@ -14,6 +14,11 @@ ad_page_contract {
 	    ad_complain "invalid value for show_patch_status"
 	}
     }
+    check_bug_number -requires bug_number:integer {
+	if {$bug_number > 2**31} {
+	    ad_complain "invalid bug number"
+	}
+    }
 }
 
 #####

programming_language: Perl
filename: patch.adp
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 <master src="../lib/master">
 <property name="doc(title)">@page_title;literal@</property>
 <property name="context">@context;literal@</property>
-<property name="displayed_object_id">@patch.patch_id;literal@</property>
+<if @patch.patch_id@ defined><property name="displayed_object_id">@patch.patch_id;literal@</property></if>
 
 <formtemplate id="patch"></formtemplate>
 

programming_language: HTML
filename: patch.tcl
change_type: ModificationType.MODIFY
diff: @@ -6,7 +6,7 @@ ad_page_contract {
     @cvs-id $Id$
 } {
     patch_number:integer,notnull
-    mode:optional
+    mode:word,optional
     cancel_edit:optional    
     edit:optional
     accept:optional
@@ -40,7 +40,7 @@ set patch_status [db_string patch_status {}]
 set versions_p [bug_tracker::versions_p]
 
 # Abort editing and return to view mode if the user hit cancel on the edit form
-if { ([info exists cancel_edit] && $cancel_edit ne "") } {
+if { [info exists cancel_edit] && $cancel_edit ne "" } {
     ad_returnredirect $view_patch_url
     ad_script_abort
 }
@@ -58,17 +58,17 @@ if { ([info exists download] && $download ne "") } {
 # Initialize the page mode variable
 # We are in view mode per default
 if { ![info exists mode] } {
-    if { ([info exists edit] && $edit ne "") } {
+    if { [info exists edit] && $edit ne "" } {
         set mode edit
-    } elseif { ([info exists accept] && $accept ne "") } {        
+    } elseif { [info exists accept] && $accept ne "" } {        
         set mode accept
-    } elseif { ([info exists refuse] && $refuse ne "") } {
+    } elseif { [info exists refuse] && $refuse ne "" } {
         set mode refuse
-    } elseif { ([info exists delete] && $delete ne "") } {
+    } elseif { [info exists delete] && $delete ne "" } {
         set mode delete
-    } elseif { ([info exists reopen] && $reopen ne "") } {
+    } elseif { [info exists reopen] && $reopen ne "" } {
         set mode reopen
-    } elseif { ([info exists comment] && $comment ne "") } {
+    } elseif { [info exists comment] && $comment ne "" } {
         set mode comment
     } else {
         set mode view
@@ -416,7 +416,7 @@ if { [form is_request patch] } {
     }
 }
 
-if { [form is_valid patch] } {
+if { [form is_valid patch] && $mode ne "view"} {
     # A valid submit of the form
 
     set update_exprs [list]

programming_language: Shell