CVE-2015-1583 (published 2020-03-02T16:15Z)

Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account via a request to mods/_core/users/create_user.php.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/atutor/ATutor
commit_details: repo_url: https://github.com/atutor/ATutor
author: atutor
author_date: 2015-02-22 16:18:00-05:00
msg: 5566 check to make sure user is not being created via CRSF remote form
repository: repo_url: https://github.com/atutor/ATutor
repo_name: atutor/ATutor
description: NO LONGER USER LEVEL SUPPORTED. CONTRIBUTING DEVELOPERS INTERESTED IN MAINTAINING ATUTOR, SHOULD REQUEST COLLABORATOR ACCESS. : ATutor is an Open Source Web-based Learning Management System (LMS) used to develop and deliver online courses. Administrators can install or update ATutor in minutes, develop custom themes to give ATutor a new look, and easily extend its functionality with feature modules. Educators can quickly assemble, package, and redistribute standardized Web-based instructional content, easily import prepackaged content, and conduct their courses online. Students learn in an accessible, adaptive, social learning environment.
repo_language: PHP
owner: atutor
file_changes: filename: create_user.php
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,14 @@
 define('AT_INCLUDE_PATH', '../../../include/');
 require(AT_INCLUDE_PATH.'vitals.inc.php');
 admin_authenticate(AT_ADMIN_PRIV_USERS);
+// Prevent remote access via CSRF: 5566
+if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
+    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
+    if(!in_array($_pages[$referer_script], $_pages)){
+    echo "not a valid referer";
+    exit;
+    }
+}
 
 if (isset($_POST['cancel'])) {
 	header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');

programming_language: PHP
repo_url: https://github.com/atutor/ATutor
commit_details: repo_url: https://github.com/atutor/ATutor
author: atutor
author_date: 2015-02-28 08:50:30-05:00
msg: 5566 added chech on referer to ensure it is in the pages array, to prevent remote access via CSRF
repository: repo_url: https://github.com/atutor/ATutor
repo_name: atutor/ATutor
description: NO LONGER USER LEVEL SUPPORTED. CONTRIBUTING DEVELOPERS INTERESTED IN MAINTAINING ATUTOR, SHOULD REQUEST COLLABORATOR ACCESS. : ATutor is an Open Source Web-based Learning Management System (LMS) used to develop and deliver online courses. Administrators can install or update ATutor in minutes, develop custom themes to give ATutor a new look, and easily extend its functionality with feature modules. Educators can quickly assemble, package, and redistribute standardized Web-based instructional content, easily import prepackaged content, and conduct their courses online. Students learn in an accessible, adaptive, social learning environment.
repo_language: PHP
owner: atutor
file_changes: filename: create.php
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,13 @@
 define('AT_INCLUDE_PATH', '../../../../include/');
 require(AT_INCLUDE_PATH.'vitals.inc.php');
 admin_authenticate(AT_ADMIN_PRIV_ADMIN);
+if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
+    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
+    if(!in_array($_pages[$referer_script], $_pages)){
+    echo "not a valid referer";
+    exit;
+    }
+}
 
 if (isset($_POST['cancel'])) {
 	$msg->addFeedback('CANCELLED');

programming_language: PHP
repo_url: https://github.com/atutor/ATutor
commit_details: repo_url: https://github.com/atutor/ATutor
author: atutor
author_date: 2015-02-28 10:23:11-05:00
msg: 5566 created a more general function to check referer, and updated create user and create admin to use it
repository: repo_url: https://github.com/atutor/ATutor
repo_name: atutor/ATutor
description: NO LONGER USER LEVEL SUPPORTED. CONTRIBUTING DEVELOPERS INTERESTED IN MAINTAINING ATUTOR, SHOULD REQUEST COLLABORATOR ACCESS. : ATutor is an Open Source Web-based Learning Management System (LMS) used to develop and deliver online courses. Administrators can install or update ATutor in minutes, develop custom themes to give ATutor a new look, and easily extend its functionality with feature modules. Educators can quickly assemble, package, and redistribute standardized Web-based instructional content, easily import prepackaged content, and conduct their courses online. Students learn in an accessible, adaptive, social learning environment.
repo_language: PHP
owner: atutor
file_changes: filename: vital_funcs.inc.php
change_type: ModificationType.MODIFY
diff: @@ -663,7 +663,23 @@ function admin_authenticate($privilege = 0, $check = false) {
 	}
 	return true;
 }
-
+/**
+ * Check if referer is in the $_pages array to prevent CSRF access
+ * @access public
+ * @return error message access denied
+ */
+function check_referer(){
+    global $_pages, $_base_href, $msg;
+    if(isset($_SERVER['HTTP_REFERER']) && $_SERVER['HTTP_REFERER'] !='' && $_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
+        $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
+        if( !in_array($_pages[$referer_script], $_pages)){
+			$msg->addError('ACCESS_DENIED');
+			require(AT_INCLUDE_PATH.'header.inc.php'); 
+			require(AT_INCLUDE_PATH.'footer.inc.php'); 
+			exit;
+        }
+    }
+}
 /**
  * Check if the give theme is a subsite customized theme. Return true if it is, otherwise, return false
  * @access public

programming_language: PHP
filename: create.php
change_type: ModificationType.MODIFY
diff: @@ -15,13 +15,9 @@
 define('AT_INCLUDE_PATH', '../../../../include/');
 require(AT_INCLUDE_PATH.'vitals.inc.php');
 admin_authenticate(AT_ADMIN_PRIV_ADMIN);
-if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
-    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
-    if(!in_array($_pages[$referer_script], $_pages)){
-    echo "not a valid referer";
-    exit;
-    }
-}
+// Prevent remote access via CSRF: 5566
+// Ref include/lib/vitals-inc.php
+check_referer();
 
 if (isset($_POST['cancel'])) {
 	$msg->addFeedback('CANCELLED');

programming_language: PHP
filename: create_user.php
change_type: ModificationType.MODIFY
diff: @@ -16,13 +16,8 @@ define('AT_INCLUDE_PATH', '../../../include/');
 require(AT_INCLUDE_PATH.'vitals.inc.php');
 admin_authenticate(AT_ADMIN_PRIV_USERS);
 // Prevent remote access via CSRF: 5566
-if($_SERVER['HTTP_REFERER'] != $_SERVER['PHP_SELF']){
-    $referer_script = preg_replace('#'.$_base_href.'#', '', $_SERVER['HTTP_REFERER']);
-    if(!in_array($_pages[$referer_script], $_pages)){
-    echo "not a valid referer";
-    exit;
-    }
-}
+// Ref include/lib/vitals-inc.php
+check_referer();
 
 if (isset($_POST['cancel'])) {
 	header('Location: '.AT_BASE_HREF.'mods/_core/users/users.php');

programming_language: PHP