CVE-2017-14143 (published 2017-09-19T15:29Z)

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-798
cwe_name: Use of Hard-coded Credentials
description: The product contains hard-coded credentials, such as a password or cryptographic key.
extended_description: 
		   There are two main variations:
		   
			 Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect.
			 Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
		   
         
         

Fix information:
repo_url: https://github.com/kaltura/server
commit_details: repo_url: https://github.com/kaltura/server
author: erankor
author_date: 2017-08-22 11:07:40+03:00
msg: remove unsafe unserialize
repository: repo_url: https://github.com/kaltura/server
repo_name: kaltura/server
description: The Kaltura Platform Backend. To install Kaltura, visit the install packages repository.
repo_language: PHP
owner: kaltura
file_changes: filename: kalturaAction.class.php
change_type: ModificationType.MODIFY
diff: @@ -453,21 +453,7 @@ abstract class kalturaAction extends sfAction
  
   protected function getUserzoneCookie() 
   {
-  	$cookie = $this->getContext()->getRequest()->getCookie('userzone');
-  	$length = strlen($cookie);
-  	if ($length <= 0)
-  		return null;
-  		
-  	$serialized_data = substr($cookie, 0, $length - 32);
-  	$hash_signiture = substr($cookie, $length - 32);
-  	  	 
-  	// check the signiture
-  	if (md5($serialized_data . $this->cookieSecret) != $hash_signiture)
-  		return null;
-  	
-  	$userzone_data = unserialize(base64_decode($serialized_data));
-  	
-  	return array($userzone_data['id'], $userzone_data['email'], $userzone_data['screenname']);
+  	return null;
   }
   
   protected function followRedirectCookie()

programming_language: PHP
filename: helperAction.class.php
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@ class helperAction extends kalturaSystemAction
 		}
 		elseif ( $algo == "wiki_decode" )
 		{
-			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
+			$res = null;
 		}
 		elseif ( $algo == "wiki_decode_no_serialize" )
 		{

programming_language: PHP
filename: KalturaInternalToolsSystemHelperAction.php
change_type: ModificationType.MODIFY
diff: @@ -51,7 +51,7 @@ class KalturaInternalToolsPluginSystemHelperAction extends KalturaApplicationPlu
 		}
 		elseif ( $algo == "wiki_decode" )
 		{
-			$res = @unserialize ( base64_decode (str_replace ( array ( "|02" , "|01" ) , array ( "/" , "|" ) , $str ) ) ) ;
+			$res = null;
 		}
 		elseif ( $algo == "wiki_decode_no_serialize" )
 		{

programming_language: PHP