CVE-2012-1617 (published 2012-09-26T00:55Z)

Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter.  NOTE: this vulnerability can be leveraged to upload arbitrary files.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/osclass/OSClass
commit_details: repo_url: https://github.com/osclass/OSClass
author: Juan Ramón
author_date: 2012-02-01 12:11:16+01:00
msg: minor check in combine.php
repository: repo_url: https://github.com/osclass/OSClass
repo_name: osclass/Osclass
description: With Osclass, get your own  classifieds site for free. Build your own Osclass installation and start advertising real estate, jobs or whatever you want- in minutes!
repo_language: PHP
owner: osclass
file_changes: filename: combine.php
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,11 @@
     $type     = $_GET['type'];
     $elements = explode(',', $_GET['files']);
 
+    if( !in_array($type, array('css', 'js')) ) {
+        header ("HTTP/1.0 403 Forbidden") ;
+        exit ;
+    }
+
     // Determine last modification date of the files
     $lastmodified = 0;
     while( list(,$element) = each($elements) ) {

programming_language: PHP
filename: combine.php
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,11 @@
     $type     = $_GET['type'];
     $elements = explode(',', $_GET['files']);
 
+    if( !in_array($type, array('css', 'js')) ) {
+        header ("HTTP/1.0 403 Forbidden") ;
+        exit ;
+    }
+
     // Determine last modification date of the files
     $lastmodified = 0;
     while( list(,$element) = each($elements) ) {

programming_language: PHP
repo_url: https://github.com/osclass/OSClass
commit_details: repo_url: https://github.com/osclass/OSClass
author: Juan Ramón
author_date: 2012-01-30 16:59:25+01:00
msg: show http 403 forbidden error if the type parameter is not js or css
repository: repo_url: https://github.com/osclass/OSClass
repo_name: osclass/Osclass
description: With Osclass, get your own  classifieds site for free. Build your own Osclass installation and start advertising real estate, jobs or whatever you want- in minutes!
repo_language: PHP
owner: osclass
file_changes: filename: combine.php
change_type: ModificationType.MODIFY
diff: @@ -24,120 +24,114 @@
      * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
      */
 
-
-    $cache       = true;
+    $cache    = true;
     $cachedir = '../../uploads';
-    $base = dirname(__FILE__);
+    $base     = dirname(__FILE__);
 
-    $type = $_GET['type'];
+    $type     = $_GET['type'];
     $elements = explode(',', $_GET['files']);
-    
+
     // Determine last modification date of the files
     $lastmodified = 0;
-    while (list(,$element) = each($elements)) {
-        $path = realpath($base . '/' . $element);
-    
-        if (($type == 'js' && substr($path, -3) != '.js') || 
-            ($type == 'css' && substr($path, -4) != '.css')) {
-            header ("HTTP/1.0 403 Forbidden");
-            exit;    
+    while( list(,$element) = each($elements) ) {
+        $path = realpath($base . '/' . $element) ;
+
+        if( ($type != 'js' && $type != 'css') || 
+            ($type == 'js' && substr($path, -3) != '.js') || 
+            ($type == 'css' && substr($path, -4) != '.css') ) {
+            header ("HTTP/1.0 403 Forbidden") ;
+            exit ;
         }
-    
+
         if (substr($path, 0, strlen($base)) != $base || !file_exists($path)) {
             header ("HTTP/1.0 404 Not Found");
             exit;
         }
-        
+
         $lastmodified = max($lastmodified, filemtime($path));
     }
 
     // Send Etag hash
     $hash = $lastmodified . '-' . md5($_GET['files']);
     header ("Etag: \"" . $hash . "\"");
-    
-    if (isset($_SERVER['HTTP_IF_NONE_MATCH']) && 
-        stripslashes($_SERVER['HTTP_IF_NONE_MATCH']) == '"' . $hash . '"') 
-    {
+
+    if( isset($_SERVER['HTTP_IF_NONE_MATCH']) && 
+        stripslashes($_SERVER['HTTP_IF_NONE_MATCH']) == '"' . $hash . '"' ) {
         // Return visit and no modifications, so do not send anything
-        header ("HTTP/1.0 304 Not Modified");
-        header ('Content-Length: 0');
-    } 
-    else 
-    {
+        header ("HTTP/1.0 304 Not Modified") ;
+        header ('Content-Length: 0') ;
+    } else {
         // First time visit or files were modified
-        if ($cache) 
-        {
+        if( $cache ) {
             // Determine supported compression method
-            $gzip = strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip');
-            $deflate = strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'deflate');
-    
+            $gzip    = strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') ;
+            $deflate = strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'deflate') ;
+
             // Determine used compression method
-            $encoding = $gzip ? 'gzip' : ($deflate ? 'deflate' : 'none');
-    
+            $encoding = $gzip ? 'gzip' : ($deflate ? 'deflate' : 'none') ;
+
             // Check for buggy versions of Internet Explorer
-            if (!strstr($_SERVER['HTTP_USER_AGENT'], 'Opera') && 
-                preg_match('/^Mozilla\/4\.0 \(compatible; MSIE ([0-9]\.[0-9])/i', $_SERVER['HTTP_USER_AGENT'], $matches)) {
-                $version = floatval($matches[1]);
-                
-                if ($version < 6)
+            if( !strstr($_SERVER['HTTP_USER_AGENT'], 'Opera') && 
+                preg_match('/^Mozilla\/4\.0 \(compatible; MSIE ([0-9]\.[0-9])/i', $_SERVER['HTTP_USER_AGENT'], $matches) ) {
+                $version = floatval($matches[1]) ;
+
+                if( $version < 6 ) {
                     $encoding = 'none';
-                    
-                if ($version == 6 && !strstr($_SERVER['HTTP_USER_AGENT'], 'EV1')) 
+                }
+                if( $version == 6 && !strstr($_SERVER['HTTP_USER_AGENT'], 'EV1') ) {
                     $encoding = 'none';
+                }
             }
-            
+
             // Try the cache first to see if the combined files were already generated
-            $cachefile = 'cache-' . $hash . '.' . $type . ($encoding != 'none' ? '.' . $encoding : '');
-            
-            if (file_exists($cachedir . '/' . $cachefile)) {
-                if ($fp = fopen($cachedir . '/' . $cachefile, 'rb')) {
+            $cachefile = 'cache-' . $hash . '.' . $type . ($encoding != 'none' ? '.' . $encoding : '') ;
 
-                    if ($encoding != 'none') {
-                        header ("Content-Encoding: " . $encoding);
+            if( file_exists($cachedir . '/' . $cachefile) ) {
+                if( $fp = fopen($cachedir . '/' . $cachefile, 'rb') ) {
+                    if( $encoding != 'none' ) {
+                        header ("Content-Encoding: " . $encoding) ;
                     }
-                
-                    header ("Content-Type: text/" . $type);
-                    header ("Content-Length: " . filesize($cachedir . '/' . $cachefile));
-        
-                    fpassthru($fp);
-                    fclose($fp);
-                    exit;
+
+                    header( "Content-Type: text/" . $type) ;
+                    header( "Content-Length: " . filesize($cachedir . '/' . $cachefile) ) ;
+
+                    fpassthru($fp) ;
+                    fclose($fp) ;
+                    exit ;
                 }
             }
         }
-    
+
         // Get contents of the files
-        $contents = '';
-        reset($elements);
-        while (list(,$element) = each($elements)) {
-            $path = realpath($base . '/' . $element);
-            $contents .= "\n\n" . file_get_contents($path);
+        $contents = '' ;
+        reset($elements) ;
+        while( list(,$element) = each($elements) ) {
+            $path      = realpath($base . '/' . $element) ;
+            $contents .= "\n\n" . file_get_contents($path) ;
         }
-    
+
         // Send Content-Type
-        header ("Content-Type: text/" . $type);
-        
-        if (isset($encoding) && $encoding != 'none') 
-        {
+        header ("Content-Type: text/" . $type) ;
+
+        if (isset($encoding) && $encoding != 'none') {
             // Send compressed contents
-            $contents = gzencode($contents, 9, $gzip ? FORCE_GZIP : FORCE_DEFLATE);
-            header ("Content-Encoding: " . $encoding);
-            header ('Content-Length: ' . strlen($contents));
-            echo $contents;
-        } 
-        else 
-        {
+            $contents = gzencode($contents, 9, $gzip ? FORCE_GZIP : FORCE_DEFLATE) ;
+            header( "Content-Encoding: " . $encoding ) ;
+            header( 'Content-Length: ' . strlen($contents) ) ;
+            echo $contents ;
+        } else {
             // Send regular contents
-            header ('Content-Length: ' . strlen($contents));
-            echo $contents;
+            header( 'Content-Length: ' . strlen($contents) ) ;
+            echo $contents ;
         }
 
         // Store cache
-        if ($cache) {
-            if ($fp = fopen($cachedir . '/' . $cachefile, 'wb')) {
-                fwrite($fp, $contents);
-                fclose($fp);
+        if( $cache ) {
+            if( $fp = fopen($cachedir . '/' . $cachefile, 'wb') ) {
+                fwrite($fp, $contents) ;
+                fclose($fp) ;
             }
         }
-    }    
-    
\ No newline at end of file
+    }
+
+?>
\ No newline at end of file

programming_language: PHP
filename: combine.php
change_type: ModificationType.MODIFY
diff: @@ -24,120 +24,114 @@
      * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
      */
 
-
-    $cache       = true;
+    $cache    = true;
     $cachedir = '../../uploads';
-    $base = dirname(__FILE__);
+    $base     = dirname(__FILE__);
 
-    $type = $_GET['type'];
+    $type     = $_GET['type'];
     $elements = explode(',', $_GET['files']);
-    
+
     // Determine last modification date of the files
     $lastmodified = 0;
-    while (list(,$element) = each($elements)) {
-        $path = realpath($base . '/' . $element);
-    
-        if (($type == 'js' && substr($path, -3) != '.js') || 
-            ($type == 'css' && substr($path, -4) != '.css')) {
-            header ("HTTP/1.0 403 Forbidden");
-            exit;    
+    while( list(,$element) = each($elements) ) {
+        $path = realpath($base . '/' . $element) ;
+
+        if( ($type != 'js' && $type != 'css') || 
+            ($type == 'js' && substr($path, -3) != '.js') || 
+            ($type == 'css' && substr($path, -4) != '.css') ) {
+            header ("HTTP/1.0 403 Forbidden") ;
+            exit ;
         }
-    
+
         if (substr($path, 0, strlen($base)) != $base || !file_exists($path)) {
             header ("HTTP/1.0 404 Not Found");
             exit;
         }
-        
+
         $lastmodified = max($lastmodified, filemtime($path));
     }
 
     // Send Etag hash
     $hash = $lastmodified . '-' . md5($_GET['files']);
     header ("Etag: \"" . $hash . "\"");
-    
-    if (isset($_SERVER['HTTP_IF_NONE_MATCH']) && 
-        stripslashes($_SERVER['HTTP_IF_NONE_MATCH']) == '"' . $hash . '"') 
-    {
+
+    if( isset($_SERVER['HTTP_IF_NONE_MATCH']) && 
+        stripslashes($_SERVER['HTTP_IF_NONE_MATCH']) == '"' . $hash . '"' ) {
         // Return visit and no modifications, so do not send anything
-        header ("HTTP/1.0 304 Not Modified");
-        header ('Content-Length: 0');
-    } 
-    else 
-    {
+        header ("HTTP/1.0 304 Not Modified") ;
+        header ('Content-Length: 0') ;
+    } else {
         // First time visit or files were modified
-        if ($cache) 
-        {
+        if( $cache ) {
             // Determine supported compression method
-            $gzip = strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip');
-            $deflate = strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'deflate');
-    
+            $gzip    = strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') ;
+            $deflate = strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'deflate') ;
+
             // Determine used compression method
-            $encoding = $gzip ? 'gzip' : ($deflate ? 'deflate' : 'none');
-    
+            $encoding = $gzip ? 'gzip' : ($deflate ? 'deflate' : 'none') ;
+
             // Check for buggy versions of Internet Explorer
-            if (!strstr($_SERVER['HTTP_USER_AGENT'], 'Opera') && 
-                preg_match('/^Mozilla\/4\.0 \(compatible; MSIE ([0-9]\.[0-9])/i', $_SERVER['HTTP_USER_AGENT'], $matches)) {
-                $version = floatval($matches[1]);
-                
-                if ($version < 6)
+            if( !strstr($_SERVER['HTTP_USER_AGENT'], 'Opera') && 
+                preg_match('/^Mozilla\/4\.0 \(compatible; MSIE ([0-9]\.[0-9])/i', $_SERVER['HTTP_USER_AGENT'], $matches) ) {
+                $version = floatval($matches[1]) ;
+
+                if( $version < 6 ) {
                     $encoding = 'none';
-                    
-                if ($version == 6 && !strstr($_SERVER['HTTP_USER_AGENT'], 'EV1')) 
+                }
+                if( $version == 6 && !strstr($_SERVER['HTTP_USER_AGENT'], 'EV1') ) {
                     $encoding = 'none';
+                }
             }
-            
+
             // Try the cache first to see if the combined files were already generated
-            $cachefile = 'cache-' . $hash . '.' . $type . ($encoding != 'none' ? '.' . $encoding : '');
-            
-            if (file_exists($cachedir . '/' . $cachefile)) {
-                if ($fp = fopen($cachedir . '/' . $cachefile, 'rb')) {
+            $cachefile = 'cache-' . $hash . '.' . $type . ($encoding != 'none' ? '.' . $encoding : '') ;
 
-                    if ($encoding != 'none') {
-                        header ("Content-Encoding: " . $encoding);
+            if( file_exists($cachedir . '/' . $cachefile) ) {
+                if( $fp = fopen($cachedir . '/' . $cachefile, 'rb') ) {
+                    if( $encoding != 'none' ) {
+                        header ("Content-Encoding: " . $encoding) ;
                     }
-                
-                    header ("Content-Type: text/" . $type);
-                    header ("Content-Length: " . filesize($cachedir . '/' . $cachefile));
-        
-                    fpassthru($fp);
-                    fclose($fp);
-                    exit;
+
+                    header( "Content-Type: text/" . $type) ;
+                    header( "Content-Length: " . filesize($cachedir . '/' . $cachefile) ) ;
+
+                    fpassthru($fp) ;
+                    fclose($fp) ;
+                    exit ;
                 }
             }
         }
-    
+
         // Get contents of the files
-        $contents = '';
-        reset($elements);
-        while (list(,$element) = each($elements)) {
-            $path = realpath($base . '/' . $element);
-            $contents .= "\n\n" . file_get_contents($path);
+        $contents = '' ;
+        reset($elements) ;
+        while( list(,$element) = each($elements) ) {
+            $path      = realpath($base . '/' . $element) ;
+            $contents .= "\n\n" . file_get_contents($path) ;
         }
-    
+
         // Send Content-Type
-        header ("Content-Type: text/" . $type);
-        
-        if (isset($encoding) && $encoding != 'none') 
-        {
+        header ("Content-Type: text/" . $type) ;
+
+        if (isset($encoding) && $encoding != 'none') {
             // Send compressed contents
-            $contents = gzencode($contents, 9, $gzip ? FORCE_GZIP : FORCE_DEFLATE);
-            header ("Content-Encoding: " . $encoding);
-            header ('Content-Length: ' . strlen($contents));
-            echo $contents;
-        } 
-        else 
-        {
+            $contents = gzencode($contents, 9, $gzip ? FORCE_GZIP : FORCE_DEFLATE) ;
+            header( "Content-Encoding: " . $encoding ) ;
+            header( 'Content-Length: ' . strlen($contents) ) ;
+            echo $contents ;
+        } else {
             // Send regular contents
-            header ('Content-Length: ' . strlen($contents));
-            echo $contents;
+            header( 'Content-Length: ' . strlen($contents) ) ;
+            echo $contents ;
         }
 
         // Store cache
-        if ($cache) {
-            if ($fp = fopen($cachedir . '/' . $cachefile, 'wb')) {
-                fwrite($fp, $contents);
-                fclose($fp);
+        if( $cache ) {
+            if( $fp = fopen($cachedir . '/' . $cachefile, 'wb') ) {
+                fwrite($fp, $contents) ;
+                fclose($fp) ;
             }
         }
-    }    
-    
\ No newline at end of file
+    }
+
+?>
\ No newline at end of file

programming_language: PHP
repo_url: https://github.com/osclass/OSClass
commit_details: repo_url: https://github.com/osclass/OSClass
author: Juan Ramón
author_date: 2012-01-16 19:44:06+01:00
msg: OSClass 2.3.5
repository: repo_url: https://github.com/osclass/OSClass
repo_name: osclass/Osclass
description: With Osclass, get your own  classifieds site for free. Build your own Osclass installation and start advertising real estate, jobs or whatever you want- in minutes!
repo_language: PHP
owner: osclass