CVE-2021-43829 (published 2021-12-14T20:15Z)

PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature. This vulnerability is capable of uploading dangerous type of file to server leading to XSS attacks and potentially other forms of code injection. Users are advised to update to 1.7.7 as soon as possible. There are no known workarounds for this issue.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/Patrowl/PatrowlManager
commit_details: repo_url: https://github.com/Patrowl/PatrowlManager
author: MaKyOtOx
author_date: 2021-12-14 11:25:29+01:00
msg: Fix Unrestricted Upload of File with Dangerous Type (from Huntr bug bounty report)
repository: repo_url: https://github.com/Patrowl/PatrowlManager
repo_name: Patrowl/PatrowlManager
description: PatrOwl - Open Source, Smart and Scalable Security Operations Orchestration Platform
repo_language: HTML
owner: Patrowl
file_changes: filename: urls.py
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@ handler404 = 'app.views.custom_page_not_found'
 handler500 = 'app.views.custom_error'
 
 
-api_schema_view = get_swagger_view(title='PatrOwl Manager REST-API')
+api_schema_view = get_swagger_view(title='PatrowlManager REST-API')
 
 urlpatterns = [
     url(r'^apis-doc', api_schema_view),

programming_language: Python
filename: forms.py
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 # -*- coding: utf-8 -*-
 
+import os
 from django import forms
 from .models import Finding, FINDING_SEVERITIES
 
@@ -9,6 +10,13 @@ ENGINE_TYPES = (
 )
 
 
+def validate_file_extension(value):
+    ext = os.path.splitext(value.name)[1]
+    valid_extensions = ['.xml', '.nessus', '.json']
+    if ext not in valid_extensions:
+        raise ValidationError(u'File not supported!')
+
+
 class ImportFindingsForm(forms.Form):
     class Meta:
         fields = ['engine', 'min_level', 'file']
@@ -20,14 +28,19 @@ class ImportFindingsForm(forms.Form):
         attrs={'class': 'form-control form-control-sm'},
         choices=FINDING_SEVERITIES),
         label='Minimum severity')
-    file = forms.FileField()
+    file = forms.FileField(widget=forms.FileInput(
+        attrs={'accept': 'text/xml,application/json'}),
+        validators=[validate_file_extension]
+    )
 
 
 class FindingForm(forms.ModelForm):
     class Meta:
         model = Finding
-        fields = ['title', 'type', 'severity', 'status', 'description', 'tags',
-            'solution', 'risk_info', 'vuln_refs', 'links', 'comments', 'asset']
+        fields = [
+            'title', 'type', 'severity', 'status', 'description', 'tags',
+            'solution', 'risk_info', 'vuln_refs', 'links', 'comments', 'asset'
+        ]
         widgets = {
             'description': forms.Textarea(
                 attrs={'class': 'form-control form-control-sm'}),

programming_language: Python