CVE-2021-4297 (published 2023-01-01T19:15Z)

A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runs_post of the file application/controllers/Restapi.php. The manipulation of the argument sourcefilename leads to an unknown weakness. Upgrading to version 1.6.5 is able to address this issue. The patch is identified as 694da5013dbecc8d30dd83e2a83e78faadf93771. It is recommended to upgrade the affected component. VDB-217174 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/trampgeek/jobe
commit_details: repo_url: https://github.com/trampgeek/jobe
author: Richard Lobb
author_date: 2021-01-31 11:33:53+13:00
msg: Prevent privilege escalation attacks via sourcefilename [issue #46](https://github.com/trampgeek/jobe/issues/46). Thanks Marlon.
repository: repo_url: https://github.com/trampgeek/jobe
repo_name: trampgeek/jobe
description: jobe is a server that runs small programming jobs in a variety of programming languages
repo_language: PHP
owner: trampgeek
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 # JOBE
 
-Version: 1.6.4, 22 January 2021
+Version: 1.6.5, 31 January 2021
 
 
 Author: Richard Lobb, University of Canterbury, New Zealand
@@ -846,3 +846,8 @@ Thanks Tim Hunt for most of the work in this addition.
 
   1. Workaround for bug in py_compile (https://bugs.python.org/issue38731)
 that results in multiple error messages when a python syntax check fails.
+
+### 1.6.5 (31 January 2021)
+
+  1. Prevent privilege escalation attacks via sourcefilename [issue #46](https://github.com/trampgeek/jobe/issues/46).
+  1. Add a load tester (ad hoc, experimental), loadtester.py.

programming_language: Markdown
filename: Restapi.php
change_type: ModificationType.MODIFY
diff: @@ -149,10 +149,12 @@ class Restapi extends REST_Controller {
             $this->error('runs_post: missing or invalid run_spec parameter', 400);
         }
         if (!is_array($run) || !isset($run['sourcecode']) ||
-                !isset($run['language_id'])
-        ) {
+                !isset($run['language_id']) ) {
             $this->error('runs_post: invalid run specification', 400);
         }
+        if (isset($run->sourcefilename) && !self::is_valid_source_filename($run->sourcefilename)) {
+            $this->error('runs_post: invalid sourcefilename');
+        }
 
         // REST_Controller has called to_array on the JSON decoded
         // object, so we must first turn it back into an object.
@@ -273,6 +275,24 @@ class Restapi extends REST_Controller {
     // **********************
     // Support functions
     // **********************
+    
+    // Return true unless the given filename looks dangerous, e.g. has '/' or '..'
+    // substrings. Uses code from https://stackoverflow.com/questions/2021624/string-sanitizer-for-filename
+    private function is_valid_source_filename($filename) {
+        $sanitised = preg_replace(
+        '~
+        [<>:"/\\|?*]|            # file system reserved https://en.wikipedia.org/wiki/Filename#Reserved_characters_and_words
+        [\x00-\x1F]|             # control characters http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247%28v=vs.85%29.aspx
+        [\x7F\xA0\xAD]|          # non-printing characters DEL, NO-BREAK SPACE, SOFT HYPHEN
+        [#\[\]@!$&\'()+,;=]|     # URI reserved https://tools.ietf.org/html/rfc3986#section-2.2
+        [{}^\~`]                 # URL unsafe characters https://www.ietf.org/rfc/rfc1738.txt
+        ~x',
+        '-', $filename);
+        // Avoid ".", ".." or ".hiddenFiles"
+        $sanitised = ltrim($sanitised, '.-');
+        return $sanitised === $filename;
+    }
+    
     private function is_valid_filespec($file) {
         return (count($file) == 2 || count($file) == 3) &&
              is_string($file[0]) &&

programming_language: PHP