CVE-2016-6189 (published 2017-02-17T17:59Z)

Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive information by reading the fields in the (1) ics or (2) XML calendar feeds.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-184
cwe_name: Incomplete List of Disallowed Inputs
description: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.
extended_description: Developers often try to protect their products against malicious input by performing tests against inputs that are known to be bad, such as special characters that can invoke new commands.  However, such lists often only account for the most well-known bad inputs. Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
         

Fix information:
repo_url: https://github.com/inverse-inc/sogo
commit_details: repo_url: https://github.com/inverse-inc/sogo
author: Ludovic Marcotte
author_date: 2016-05-27 10:53:16-04:00
msg: (fix) improved previous commit for attributes stripping and UID generation (fixes #3695 and #3696)
repository: repo_url: https://github.com/inverse-inc/sogo
repo_name: Alinto/sogo
description: SOGo is a very fast and scalable modern collaboration suite (groupware). It offers calendaring, address book management, and a full-featured Webmail client along with resource sharing and permission handling. It also makes use of documented standards (IMAP, CalDAV, CardDAV, etc.) and thereby provides native connectivity (without plugins) to many clients such as Microsoft Outlook, Apple iCal, the iPhone, Mozilla Lightning, and a plethora of mobile devices.
repo_language: Objective-C
owner: inverse-inc
file_changes: filename: SOGoCalendarComponent.m
change_type: ModificationType.MODIFY
diff: @@ -41,12 +41,14 @@
 #import <SOGo/NSDictionary+Utilities.h>
 #import <SOGo/NSObject+DAV.h>
 #import <SOGo/NSObject+Utilities.h>
+#import <SOGo/NSString+Crypto.h>
 #import <SOGo/NSString+Utilities.h>
 #import <SOGo/SOGoBuild.h>
 #import <SOGo/SOGoMailer.h>
 #import <SOGo/SOGoGroup.h>
 #import <SOGo/SOGoPermissions.h>
 #import <SOGo/SOGoUser.h>
+#import <SOGo/SOGoUserSettings.h>
 #import <SOGo/SOGoSystemDefaults.h>
 #import <SOGo/SOGoUserManager.h>
 #import <SOGo/SOGoWebDAVAclManager.h>
@@ -202,14 +204,21 @@
 
 - (void) _filterComponent: (iCalEntityObject *) component
 {
-  NSString *type, *summary, *tag;
-  NSArray *children;
+  NSString *type, *summary, *tag, *uid;
+  SOGoUserSettings *settings;
+  SOGoUser *calendarOwner;
+  NSEnumerator *children;
+  CardElement *element;
+  NSArray *tags;
 
-  int classification, i;
+  int classification;
 
   type = @"vtodo";
   classification = 0;
 
+  calendarOwner = [SOGoUser userWithLogin: [self ownerInContext: context]];
+  settings = [calendarOwner userSettings];
+
   if ([component isKindOfClass: [iCalEvent class]])
     type = @"vevent";
   
@@ -221,25 +230,23 @@
   summary = [self labelForKey: [NSString stringWithFormat: @"%@_class%d",
                                          type, classification]
                     inContext: context];
-  [component setSummary: summary];
-  [component setComment: @""];
-  [component setUserComment: @""];
-  [component setLocation: @""];
-  [component setCategories: [NSArray array]];
-  [component setUrl: @""];
-  [component setOrganizer: nil];
-  [component removeAllAttendees];
-  [component removeAllAlarms];
-
-  // We strip all X- tags
-  children = [component children];
-
-  for (i = 0; i < [children count]; i++)
+
+  tags = [NSArray arrayWithObjects: @"DTSTAMP", @"DTSTART", @"DTEND", @"DUE", @"EXDATE", @"EXRULE", @"RRULE", nil];
+  uid = [[component uid] asCryptedPassUsingScheme: @"ssha256"
+                                         withSalt: [[settings userSalt] dataUsingEncoding: NSASCIIStringEncoding]
+                                      andEncoding: encHex];
+
+  children = [[[[component children] copy] autorelease] objectEnumerator];
+
+  while ((element = [children nextObject]))
     {
-      tag = [[children objectAtIndex: i] tag];
-      if ([[tag uppercaseString] hasPrefix: @"X-"])
-        [component removeChild: [children objectAtIndex: i]];
+      tag = [element tag];
+      if (![tags containsObject: [tag uppercaseString]])
+        [component removeChild: element];
     }
+
+  [component setSummary: summary];
+  [component setUid: uid];
 }
 
 - (NSString *) secureContentAsString

programming_language: Objective-C
filename: SOGoUserSettings.h
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 /* SOGoUserSettings.h - this file is part of SOGo
  *
- * Copyright (C) 2009-2014 Inverse inc.
+ * Copyright (C) 2009-2016 Inverse inc.
  *
  * This file is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -33,6 +33,7 @@
 
 - (NSArray *) subscribedCalendars;
 - (NSArray *) subscribedAddressBooks;
+- (NSString *) userSalt;
 
 @end
 

programming_language: Objective-C
filename: SOGoUserSettings.m
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 /* SOGoUserSettings.m - this file is part of SOGo
  *
- * Copyright (C) 2009-2014 Inverse inc.
+ * Copyright (C) 2009-2016 Inverse inc.
  *
  * This file is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -19,9 +19,11 @@
  */
 
 #import <Foundation/NSDictionary.h>
+#import <Foundation/NSProcessInfo.h>
 #import <Foundation/NSString.h>
 
 #import "SOGoUserProfile.h"
+#import "NSString+Crypto.h"
 
 #import "SOGoUserSettings.h"
 
@@ -68,4 +70,28 @@ static Class SOGoUserProfileKlass = Nil;
   return [self _subscribedFoldersForModule: @"Contacts"];
 }
 
+- (NSString *) userSalt
+{
+  NSMutableDictionary *values;
+  NSString *salt;
+
+  salt = [[self dictionaryForKey: @"General"] objectForKey: @"Salt"];
+
+  if (!salt)
+    {
+      salt = [[[NSProcessInfo processInfo] globallyUniqueString] asSHA1String];
+      values = [self objectForKey: @"General"];
+
+      if (!values)
+        values = [NSMutableDictionary dictionary];
+
+      [values setObject: salt  forKey: @"Salt"];
+      [self setObject:  values forKey: @"General"];
+      [self synchronize];
+    }
+
+  return salt;
+}
+
+
 @end

programming_language: Objective-C