CVE-2022-1811 (published 2022-05-23T16:16Z)

Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/publify/publify
commit_details: repo_url: https://github.com/publify/publify
author: Matijs van Zuijlen
author_date: 2022-05-22 15:25:53+02:00
msg: Refuse html files as resources even if declared to be plain text
repository: repo_url: https://github.com/publify/publify
repo_name: publify/publify
description: A self hosted Web publishing platform on Rails.
repo_language: Less
owner: publify
file_changes: filename: resource_uploader.rb
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ require "marcel"
 
 class ResourceUploader < CarrierWave::Uploader::Base
   include CarrierWave::MiniMagick
-  before :cache, :check_image_content_type!
+  before :cache, :check_content_type!
 
   def content_type_allowlist
     [%r{image/}, %r{audio/}, %r{video/}, "text/plain"]
@@ -37,26 +37,24 @@ class ResourceUploader < CarrierWave::Uploader::Base
     content_type&.include?("image")
   end
 
-  def check_image_content_type!(new_file)
-    if image?(new_file)
-      magic_type = mime_magic_content_type(new_file)
-      if magic_type != new_file.content_type
-        raise CarrierWave::IntegrityError, "has MIME type mismatch"
-      end
+  def check_content_type!(new_file)
+    detected_type = if image? new_file
+                      file_content_content_type(new_file)
+                    else
+                      file_content_type(new_file)
+                    end
+    if detected_type != new_file.content_type
+      raise CarrierWave::IntegrityError, "has MIME type mismatch"
     end
   end
 
   private
 
-  # NOTE: This method was adapted from MagicMimeBlacklist#extract_content_type
-  # from CarrierWave 1.0.0 and SanitizedFile#mime_magic_content_type from CarrierWave 0.11.2
-  def mime_magic_content_type(new_file)
-    content_type = nil
-
-    File.open(new_file.path) do |fd|
-      content_type = Marcel::MimeType.for(fd)
-    end
+  def file_content_content_type(new_file)
+    Marcel::MimeType.for Pathname.new(new_file.path)
+  end
 
-    content_type
+  def file_content_type(new_file)
+    Marcel::MimeType.for Pathname.new(new_file.path), name: new_file.filename
   end
 end

programming_language: Ruby
filename: resources_controller_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -187,6 +187,30 @@ describe Admin::ResourcesController, type: :controller do
       end
     end
 
+    context "when attempting to upload an html file as text/plain" do
+      let(:upload) { file_upload("just_some.html", "text/plain") }
+
+      it "does not create a new Resource" do
+        expect { post :upload, params: { upload: upload } }.
+          not_to change(Resource, :count)
+      end
+
+      it "warns the user they can't upload this type of file" do
+        post :upload, params: { upload: upload }
+        result = assigns(:up)
+        expect(result.errors[:upload]).
+          to match_array ["has MIME type mismatch", "can't be blank"]
+      end
+
+      it "sets the flash to failure" do
+        post :upload, params: { upload: upload }
+        aggregate_failures do
+          expect(flash[:success]).to be_nil
+          expect(flash[:warning]).not_to be_nil
+        end
+      end
+    end
+
     context "when uploading nothing" do
       it "does not create a new Resource" do
         expect { post :upload }.

programming_language: Ruby