CVE-2016-6639 (published 2016-09-18T02:59Z)

Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products, place the .profile file in the htdocs directory, which might allow remote attackers to obtain sensitive information via an HTTP GET request for this file.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-254
cwe_name: 7PK - Security Features
description: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Fix information:
repo_url: https://github.com/cloudfoundry/php-buildpack
commit_details: repo_url: https://github.com/cloudfoundry/php-buildpack
author: Jacques Chester
author_date: 2016-08-12 17:58:52-04:00
msg: Execute .profile script at runtime

- Add integration showing that .profile script runs.
- Add unit test for all top-level system files which are not meant to
  be moved into the htdocs directory.
- Move a stray assertion about not moving manifest.yml to the new test.
- Add .profile to the list of files/dirs which should not be moved from
  the toplevel into htdocs/

[#127923697]

Signed-off-by: Sam Smith <sesmith177@gmail.com>
Signed-off-by: Jacques Chester <jchester@pivotal.io>
repository: repo_url: https://github.com/cloudfoundry/php-buildpack
repo_name: cloudfoundry/php-buildpack
description: A Cloud Foundry Buildpack for PHP.
repo_language: Python
owner: cloudfoundry
file_changes: filename: .profile
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+export PROFILE_SCRIPT_IS_PRESENT_AND_RAN="Hooray for environment variables!"
\ No newline at end of file

programming_language: Shell
filename: index.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+<?php echo phpinfo() ?>

programming_language: PHP
filename: profile_d_sets_environment_variables_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -17,4 +17,18 @@ describe 'CF PHP Buildpack' do
       expect(browser).to have_body('TEST_ENV_VAR')
     end
   end
+
+  context 'deploying a PHP app with .profile script' do
+    let(:app_name) { 'php_app_with_profile_script' }
+
+    it "sets environment variables via .profile script" do
+      cf_api_output = Machete::CF::API.new.execute
+
+      cf_api_version = cf_api_output.match( /API version: (?<version_number>\d+\.\d+\.\d+)/ )['version_number']
+      minimum_acceptable_cf_api_version = Gem::Version.new('2.57.0')
+      skip(".profile script functionality not supported before CF API version #{minimum_acceptable_cf_api_version}") if Gem::Version.new(cf_api_version) < minimum_acceptable_cf_api_version
+      browser.visit_path('/')
+      expect(browser).to have_body('PROFILE_SCRIPT_IS_PRESENT_AND_RAN')
+    end
+  end
 end

programming_language: Ruby
filename: compile_helpers.py
change_type: ModificationType.MODIFY
diff: @@ -54,6 +54,8 @@ def setup_webdir_if_it_doesnt_exist(ctx):
                 '^%s/.*$' % os.path.join(ctx['BUILD_DIR'], ctx['LIBDIR']))
             fu.where_name_does_not_match(
                 '^%s/.*$' % os.path.join(ctx['BUILD_DIR'], '.profile.d'))
+            fu.where_name_does_not_match(
+                '^%s$' % os.path.join(ctx['BUILD_DIR'], '.profile'))
             fu.done()
 
 

programming_language: Python
filename: README.txt
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+This directory is not a "real" app. It is a fixture intended to support test_system_files_not_moved_into_webdir. That's why all the files and folders are empty.
\ No newline at end of file

programming_language: SQL
filename: test_compile_helpers.py
change_type: ModificationType.MODIFY
diff: @@ -120,7 +120,6 @@ class TestCompileHelpers(object):
         self.assert_exists(self.build_dir, '.bp-config', 'options.json')
         self.assert_exists(self.build_dir, '.bp-config', 'httpd', 'extra',
                            'httpd-remoteip.conf')
-        self.assert_exists(self.build_dir, 'manifest.yml')
         eq_(4, len(os.listdir(self.build_dir)))
         eq_(4, len(os.listdir(os.path.join(self.build_dir, 'htdocs'))))
 
@@ -195,6 +194,20 @@ class TestCompileHelpers(object):
         eq_(4, len(os.listdir(self.build_dir)))
         eq_(3, len(os.listdir(os.path.join(self.build_dir, 'public'))))
 
+    def test_system_files_not_moved_into_webdir(self):
+        shutil.copytree('tests/data/app-with-all-possible-system-files-that-should-not-move', self.build_dir)
+        setup_webdir_if_it_doesnt_exist(utils.FormattedDict({
+            'BUILD_DIR': self.build_dir,
+            'WEBDIR': 'htdocs',
+            'LIBDIR': 'lib'
+        }))
+        self.assert_exists(self.build_dir, '.bp')
+        self.assert_exists(self.build_dir, '.extensions')
+        self.assert_exists(self.build_dir, '.bp-config')
+        self.assert_exists(self.build_dir, 'manifest.yml')
+        self.assert_exists(self.build_dir, '.profile.d')
+        self.assert_exists(self.build_dir, '.profile')
+
     def test_setup_if_htdocs_with_stand_alone_app(self):
         shutil.copytree('tests/data/app-5', self.build_dir)
         setup_webdir_if_it_doesnt_exist(utils.FormattedDict({

programming_language: Python