CVE-2017-8098 (published 2017-04-24T18:59Z)

e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/e107inc/e107
commit_details: repo_url: https://github.com/e107inc/e107
author: Cameron
author_date: 2017-03-02 12:51:03-08:00
msg: Token fixes.
repository: repo_url: https://github.com/e107inc/e107
repo_name: e107inc/e107
description: e107 Bootstrap CMS (Content Management System) v2 with PHP, MySQL, HTML5, jQuery and Twitter Bootstrap. Issue Discussion Room: https://gitter.im/e107inc/e107 
repo_language: PHP
owner: e107inc
file_changes: filename: frontpage.php
change_type: ModificationType.MODIFY
diff: @@ -18,6 +18,10 @@
  *	@version 	$Id$;
  */
 
+if(!empty($_POST) && !isset($_POST['e-token']))
+{
+	$_POST['e-token'] = '';
+}
 require_once ('../class2.php');
 if(! getperms('G'))
 {
@@ -392,6 +396,7 @@ class frontpage
 		$show_legend = $show_button ? " class='e-hideme'" : '';
 		$text = "
 		<form method='post' action='".e_SELF."'>
+		<input type='hidden' name='e-token' value='".e_TOKEN."' />
 			<fieldset id='frontpage-settings'>
 				<legend{$show_legend}>".FRTLAN_13."</legend>
 
@@ -494,7 +499,9 @@ class frontpage
 // <legend class='e-hideme'>".($rule_info['order'] ? FRTLAN_46 : FRTLAN_42)."</legend>
 
 		$text = "
-		<form method='post' action='".e_SELF."'>";
+		<form method='post' action='".e_SELF."'>
+		<input type='hidden' name='e-token' value='".e_TOKEN."' />
+		";
 		
 		$text .= '<ul class="nav nav-tabs" id="myTabs">
 			<li class="active"><a data-toggle="tab" href="#home">'.FRTLAN_49.'</a></li>

programming_language: PHP
filename: meta.php
change_type: ModificationType.MODIFY
diff: @@ -10,6 +10,10 @@
  *
  *
 */
+if(!empty($_POST) && !isset($_POST['e-token']))
+{
+	$_POST['e-token'] = '';
+}
 require_once("../class2.php");
 
 if (!getperms("T")) 
@@ -128,6 +132,7 @@ $text = "
 			<div class='buttons-bar center'>".
 				$frm->admin_button('metasubmit','no-value','update', LAN_UPDATE)."
 			</div>
+			<input type='hidden' name='e-token' value='".e_TOKEN."' />
 		</fieldset>
 	</form>
 ";

programming_language: PHP
filename: plugin.php
change_type: ModificationType.MODIFY
diff: @@ -212,7 +212,6 @@ class plugin_ui extends e_admin_ui
 			}
 
 
-
 			if($this->getMode()=== 'avail')
 			{
 				$this->listQry  = "SELECT * FROM `#plugin` WHERE plugin_installflag = 0 AND plugin_category != 'menu'  ";
@@ -397,7 +396,10 @@ class plugin_ui extends e_admin_ui
 
 			$post = e107::getParser()->filter($_POST);
 
-
+			if(empty($_POST['e-token']))
+			{
+				return false;
+			}
 
 		//	$id = e107::getPlugin
 
@@ -811,13 +813,15 @@ class plugin_ui extends e_admin_ui
 			*/
              //   $frm->admin_button($name, $value, $action = 'submit', $label = '', $options = array());
 
-			$text .= "</div>
+
+
+			$text .= "<input type='hidden' name='e-token' value='".e_TOKEN."' /></div>
 			</fieldset>
 			</form>
 			";
 
 			return $text;
-			e107::getRender()->tablerender(EPL_ADLAN_63.SEP.$tp->toHtml($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable"),$mes->render(). $text);
+		//	e107::getRender()->tablerender(EPL_ADLAN_63.SEP.$tp->toHtml($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable"),$mes->render(). $text);
 
 		}
 	/*

programming_language: PHP
filename: prefs.php
change_type: ModificationType.MODIFY
diff: @@ -10,6 +10,10 @@
  *
  */
 
+if(!empty($_POST) && !isset($_POST['e-token']))
+{
+	$_POST['e-token'] = '';
+}
 require_once ("../class2.php");
 
 if(isset($_POST['newver']))
@@ -309,6 +313,7 @@ $pref['membersonly_exceptions'] = implode("\n",$pref['membersonly_exceptions']);
 $text = "
 <div id='core-prefs'>
 	<form class='admin-menu' method='post' action='".e_SELF."' autocomplete='off'>
+	<input type='hidden' name='e-token' value='".e_TOKEN."' />
 		<fieldset id='core-prefs-main'>
 			<legend>".PRFLAN_1."</legend>
 			<table class='table adminform'>

programming_language: PHP