CVE-2023-49508 (published 2024-02-16T08:15Z)

Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php component.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/YetiForceCompany/YetiForceCRM
commit_details: repo_url: https://github.com/YetiForceCompany/YetiForceCRM
author: Radosław Skrzypczak
author_date: 2023-07-17 09:10:15+02:00
msg: Improved loading of details and licenses of dependent libraries
repository: repo_url: https://github.com/YetiForceCompany/YetiForceCRM
repo_name: YetiForceCompany/YetiForceCRM
description: Our team created for you one of the most innovative CRM systems that supports mainly business processes and allows for customization according to your needs. Be ahead of your competition and implement YetiForce!
repo_language: PHP
owner: YetiForceCompany
file_changes: filename: version.php
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 <?php
 
 return [
-	'appVersion' => '6.4.270',
-	'patchVersion' => '2023.07.14',
+	'appVersion' => '6.4.271',
+	'patchVersion' => '2023.07.17',
 	'lib_roundcube' => '0.3.4',
 ];

programming_language: PHP
filename: LibraryMoreInfo.tpl
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,7 @@
 	<div class="modal-body col-md-12">
 		{if $RESULT}
 			<code>
-				<pre>{$FILE_CONTENT}</pre>
+				<pre>{$FILE_CONTENT|escape}</pre>
 			</code>
 		{else}
 			<div class="alert alert-danger" role="alert">

programming_language: PHP
filename: LibraryLicense.php
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,7 @@
  * @copyright YetiForce S.A.
  * @license   YetiForce Public License 5.0 (licenses/LicenseEN.txt or yetiforce.com)
  * @author    Adrian Koń <a.kon@yetiforce.com>
+ * @author    Radosław Skrzypczak <r.skrzypczak@yetiforce.com>
  */
 class Settings_Dependencies_LibraryLicense_View extends Settings_Vtiger_BasicModal_View
 {
@@ -36,8 +37,8 @@ class Settings_Dependencies_LibraryLicense_View extends Settings_Vtiger_BasicMod
 			$result = false;
 		} else {
 			$dir = ROOT_DIRECTORY . DIRECTORY_SEPARATOR . 'licenses' . DIRECTORY_SEPARATOR;
-			$filePath = $dir . $request->getByType('license', 'Text') . '.txt';
-			if (file_exists($filePath)) {
+			$filePath = $dir . $request->getByType('license', \App\Purifier::PATH) . '.txt';
+			if (file_exists($filePath) && \App\Fields\File::isAllowedFileDirectory($filePath)) {
 				$result = true;
 				$fileContent = file_get_contents($filePath);
 			} else {

programming_language: PHP
filename: LibraryMoreInfo.php
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,7 @@
  * @copyright YetiForce S.A.
  * @license   YetiForce Public License 5.0 (licenses/LicenseEN.txt or yetiforce.com)
  * @author    Adrian Koń <a.kon@yetiforce.com>
+ * @author    Radosław Skrzypczak <r.skrzypczak@yetiforce.com>
  */
 class Settings_Dependencies_LibraryMoreInfo_View extends Settings_Vtiger_BasicModal_View
 {
@@ -23,34 +24,25 @@ class Settings_Dependencies_LibraryMoreInfo_View extends Settings_Vtiger_BasicMo
 	{
 		$result = false;
 		$fileContent = '';
-		if ($request->isEmpty('type') || $request->isEmpty('libraryName')) {
-			$result = false;
-		} else {
-			if ('public' === $request->getByType('type', 1)) {
+		if (!$request->isEmpty('type') && !$request->isEmpty('libraryName')) {
+			$type = $request->getByType('type', \App\Purifier::STANDARD);
+			if ('public' === $type) {
 				$dir = ROOT_DIRECTORY . DIRECTORY_SEPARATOR . 'public_html' . DIRECTORY_SEPARATOR . 'libraries' . DIRECTORY_SEPARATOR;
-				$libraryName = $request->getByType('libraryName', 'Text');
+				$libraryName = $request->getByType('libraryName', \App\Purifier::PATH);
 				foreach ($this->packageFiles as $file) {
 					$packageFile = $dir . $libraryName . DIRECTORY_SEPARATOR . $file;
-					if ($fileContent) {
-						continue;
-					}
-					if (file_exists($packageFile)) {
+					if (file_exists($packageFile) && \App\Fields\File::isAllowedFileDirectory($packageFile)) {
 						$fileContent = file_get_contents($packageFile);
 						$result = true;
-					} else {
-						$result = false;
+						break;
 					}
 				}
-			} elseif ('vendor' === $request->getByType('type', 1)) {
-				$filePath = 'vendor' . DIRECTORY_SEPARATOR . $request->getByType('libraryName', 'Text') . DIRECTORY_SEPARATOR . 'composer.json';
-				if (file_exists($filePath)) {
+			} elseif ('vendor' === $type) {
+				$filePath = ROOT_DIRECTORY . DIRECTORY_SEPARATOR . 'vendor' . DIRECTORY_SEPARATOR . $request->getByType('libraryName', \App\Purifier::PATH) . DIRECTORY_SEPARATOR . 'composer.json';
+				if (file_exists($filePath) && \App\Fields\File::isAllowedFileDirectory($filePath)) {
 					$fileContent = file_get_contents($filePath);
 					$result = true;
-				} else {
-					$result = false;
 				}
-			} else {
-				$result = false;
 			}
 		}
 		$this->preProcess($request);

programming_language: PHP