CVE-2016-4040 (published 2016-04-19T14:59Z)

SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/dotCMS/core
commit_details: repo_url: https://github.com/dotCMS/core
author: Will Ezell
author_date: 2016-04-07 08:46:15-04:00
msg: fixes #8840 sort by sanitizing and email header injection
repository: repo_url: https://github.com/dotCMS/core
repo_name: dotCMS/core
description: Headless/Hybrid Content Management System for Enterprises
repo_language: Java
owner: dotCMS
file_changes: filename: SubmitWebFormAction.java
change_type: ModificationType.MODIFY
diff: @@ -109,6 +109,7 @@ public final class SubmitWebFormAction extends DispatchAction {
 				if(!UtilMethods.isSet(invalidCaptchaURL)) {
 					invalidCaptchaURL = errorURL;
 				}
+				invalidCaptchaURL = invalidCaptchaURL.replaceAll("\\s", " ");
 				ActionForward af = new ActionForward();
 					af.setRedirect(true);
 					if (UtilMethods.isSet(queryString)) {

programming_language: Java
filename: EmailFactory.java
change_type: ModificationType.MODIFY
diff: @@ -418,6 +418,23 @@ public class EmailFactory {
 				String subject = (String)getMapValue("subject", parameters);
 				subject = (subject == null) ? "Mail from " + host.getHostname() + "" : subject;
 
+				
+				// strip line breaks from headers
+				from = from.replaceAll("\\s", " ");
+				to = to.replaceAll("\\s", " ");
+				cc = cc.replaceAll("\\s", " ");
+				bcc = bcc.replaceAll("\\s", " ");
+				fromName = fromName.replaceAll("\\s", " ");
+				subject = subject.replaceAll("\\s", " ");
+				
+				
+				
+				
+				
+				
+				
+				
+				
 				String emailFolder = (String)getMapValue("emailFolder", parameters);
 
 				boolean html = getMapValue("html", parameters) != null?Parameter.getBooleanFromString((String)getMapValue("html", parameters)):true;

programming_language: Java
filename: WorkflowSearcher.java
change_type: ModificationType.MODIFY
diff: @@ -5,6 +5,7 @@ import java.util.List;
 import java.util.Map;
 
 import com.dotmarketing.business.APILocator;
+import com.dotmarketing.common.util.SQLUtil;
 import com.dotmarketing.exception.DotDataException;
 import com.dotmarketing.util.UtilMethods;
 import com.liferay.portal.model.User;
@@ -100,6 +101,9 @@ public class WorkflowSearcher {
 		stepId = getStringValue("stepId", map);
 		keywords = getStringValue("keywords", map);
 		orderBy = getStringValue("orderBy", map);
+		
+		
+		orderBy= SQLUtil.sanitizeSortBy(orderBy);
 		show4all = getBooleanValue("show4all", map);
 		open = getBooleanValue("open", map);
 		closed = getBooleanValue("closed", map);
@@ -135,7 +139,7 @@ public class WorkflowSearcher {
 	}
 
 	public String getOrderBy() {
-		return orderBy;
+		return SQLUtil.sanitizeSortBy(orderBy);
 	}
 
 	public List<WorkflowTask> findTasks() throws DotDataException {
@@ -154,6 +158,7 @@ public class WorkflowSearcher {
 	}
 
 	public void setOrderBy(String orderBy) {
+		orderBy = SQLUtil.sanitizeSortBy(orderBy);
 		this.orderBy = orderBy;
 	}
 

programming_language: Java