CVE-2022-39297 (published 2022-10-12T23:15Z)

MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools. Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication. Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1. This issue was addressed by restricting allowed classes when deserializing user-controlled data.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/melisplatform/melis-cms
commit_details: repo_url: https://github.com/melisplatform/melis-cms
author: Maria Teresa Pomar
author_date: 2022-09-26 16:40:31+08:00
msg: added allowed_classes=false param to unserialize func
repository: repo_url: https://github.com/melisplatform/melis-cms
repo_name: melisplatform/melis-cms
description: MelisCms provides a full CMS for Melis Platform, including templating system, drag'n'drop of plugins, SEO and many administration tools.
repo_language: PHP
owner: melisplatform
file_changes: filename: FrontPluginsController.php
change_type: ModificationType.MODIFY
diff: @@ -89,7 +89,7 @@ class FrontPluginsController extends MelisAbstractActionController
 
         $pluginHardcodedConfig = html_entity_decode($pluginHardcodedConfig, ENT_QUOTES);
         $pluginHardcodedConfig = html_entity_decode($pluginHardcodedConfig, ENT_QUOTES);
-        $pluginHardcodedConfig = unserialize($pluginHardcodedConfig);
+        $pluginHardcodedConfig = unserialize($pluginHardcodedConfig, ['allowed_classes' => false]);  
 
         $errors = '';
         $tag = '';

programming_language: PHP
filename: SitesConfigController.php
change_type: ModificationType.MODIFY
diff: @@ -141,14 +141,14 @@ class SitesConfigController extends MelisAbstractActionController
             if ($dbConfig['sconf_lang_id'] == '-1') {
                 $dbConfig['sconf_datas'] = [
                     'site' => [
-                        $siteName => unserialize($dbConfig['sconf_datas'])
+                        $siteName => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                     ],
                 ];
             } else {
                 $dbConfig['sconf_datas'] = [
                     'site' => [
                         $siteName => [
-                            $siteId => unserialize($dbConfig['sconf_datas'])
+                            $siteId => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                         ],
                     ],
                 ];

programming_language: PHP
filename: SitesController.php
change_type: ModificationType.MODIFY
diff: @@ -1537,14 +1537,14 @@ class SitesController extends MelisAbstractActionController
             if ($dbConfig['sconf_lang_id'] == '-1') {
                 $dbConfig['sconf_datas'] = [
                     'site' => [
-                        $siteName => unserialize($dbConfig['sconf_datas']),
+                        $siteName => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false]),
                     ],
                 ];
             } else {
                 $dbConfig['sconf_datas'] = [
                     'site' => [
                         $siteName => [
-                            $siteId => unserialize($dbConfig['sconf_datas'])
+                            $siteId => unserialize($dbConfig['sconf_datas'], ['allowed_classes' => false])
                         ],
                     ],
                 ];

programming_language: PHP