CVE-2022-0692 (published 2022-02-21T13:15Z)

Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-601
cwe_name: URL Redirection to Untrusted Site ('Open Redirect')
description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
extended_description: An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
         

Fix information:
repo_url: https://github.com/rudloff/alltube
commit_details: repo_url: https://github.com/rudloff/alltube
author: Pierre Rudloff
author_date: 2022-02-20 13:28:57+01:00
msg: Don't redirect to REQUEST_URI when browsing to index.php
Instead, we can make sure everything works correctly on index.php
repository: repo_url: https://github.com/rudloff/alltube
repo_name: Rudloff/alltube
description: Web GUI for youtube-dl
repo_language: PHP
owner: rudloff
file_changes: filename: ViewFactory.php
change_type: ModificationType.MODIFY
diff: @@ -37,6 +37,25 @@ class ViewFactory
             ->withScheme('https');
     }
 
+    /**
+     * @param Uri $uri
+     * @return Uri
+     */
+    private static function cleanBasePath(Uri $uri): Uri
+    {
+        $basePath = $uri->getBasePath();
+        if (str_ends_with($basePath, 'index.php')) {
+            /*
+             * When the base path ends with index.php,
+             * routing works correctly, but it breaks the URL of static assets using {base_url}.
+             * So we alter the base path but only in the URI used by SmartyPlugins.
+             */
+            $uri = $uri->withBasePath(dirname($basePath));
+        }
+
+        return $uri;
+    }
+
     /**
      * Create Smarty view object.
      *
@@ -76,6 +95,8 @@ class ViewFactory
         /** @var LocaleManager $localeManager */
         $localeManager = $container->get('locale');
 
+        $uri = self::cleanBasePath($uri);
+
         $smartyPlugins = new SmartyPlugins($container->get('router'), $uri->withUserInfo(''));
         $view->registerPlugin('function', 'path_for', [$smartyPlugins, 'pathFor']);
         $view->registerPlugin('function', 'base_url', [$smartyPlugins, 'baseUrl']);

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -5,11 +5,6 @@ require_once __DIR__ . '/vendor/autoload.php';
 use Alltube\App;
 use Alltube\ErrorHandler;
 
-if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], '/index.php') !== false) {
-    header('Location: ' . str_ireplace('/index.php', '/', $_SERVER['REQUEST_URI']));
-    die;
-}
-
 try {
     // Create app.
     $app = new App();

programming_language: PHP
filename: logo.tpl
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 <h1 class="logobis">
-    <a class="logocompatible" href="{base_url}">
+    <a class="logocompatible" href="{path_for name="index"}">
         <span class="logocompatiblemask"><img src="{base_url}/img/logocompatiblemask.png" width="447" height="107"
                                               alt="{$config->appName}"/></span>
     </a></h1>

programming_language: Markdown
filename: ViewFactory.php
change_type: ModificationType.MODIFY
diff: @@ -37,6 +37,25 @@ class ViewFactory
             ->withScheme('https');
     }
 
+    /**
+     * @param Uri $uri
+     * @return Uri
+     */
+    private static function cleanBasePath(Uri $uri): Uri
+    {
+        $basePath = $uri->getBasePath();
+        if (str_ends_with($basePath, 'index.php')) {
+            /*
+             * When the base path ends with index.php,
+             * routing works correctly, but it breaks the URL of static assets using {base_url}.
+             * So we alter the base path but only in the URI used by SmartyPlugins.
+             */
+            $uri = $uri->withBasePath(dirname($basePath));
+        }
+
+        return $uri;
+    }
+
     /**
      * Create Smarty view object.
      *
@@ -76,6 +95,8 @@ class ViewFactory
         /** @var LocaleManager $localeManager */
         $localeManager = $container->get('locale');
 
+        $uri = self::cleanBasePath($uri);
+
         $smartyPlugins = new SmartyPlugins($container->get('router'), $uri->withUserInfo(''));
         $view->registerPlugin('function', 'path_for', [$smartyPlugins, 'pathFor']);
         $view->registerPlugin('function', 'base_url', [$smartyPlugins, 'baseUrl']);

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -5,11 +5,6 @@ require_once __DIR__ . '/vendor/autoload.php';
 use Alltube\App;
 use Alltube\ErrorHandler;
 
-if (isset($_SERVER['REQUEST_URI']) && strpos($_SERVER['REQUEST_URI'], '/index.php') !== false) {
-    header('Location: ' . str_ireplace('/index.php', '/', $_SERVER['REQUEST_URI']));
-    die;
-}
-
 try {
     // Create app.
     $app = new App();

programming_language: PHP
filename: logo.tpl
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 <h1 class="logobis">
-    <a class="logocompatible" href="{base_url}">
+    <a class="logocompatible" href="{path_for name="index"}">
         <span class="logocompatiblemask"><img src="{base_url}/img/logocompatiblemask.png" width="447" height="107"
                                               alt="{$config->appName}"/></span>
     </a></h1>

programming_language: Markdown