CVE-2017-16754 (published 2017-11-10T02:29Z)

Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-732
cwe_name: Incorrect Permission Assignment for Critical Resource
description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
extended_description: When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.
         

Fix information:
repo_url: https://github.com/bolt/bolt
commit_details: repo_url: https://github.com/bolt/bolt
author: Gawain Lynch
author_date: 2017-09-26 17:14:28+02:00
msg: Request listener to prevent access to profiler routes
repository: repo_url: https://github.com/bolt/bolt
repo_name: bolt/bolt
description: Bolt is a simple CMS written in PHP. It is based on Silex and Symfony components, uses Twig and either SQLite, MySQL or PostgreSQL.
repo_language: PHP
owner: bolt
file_changes: filename: ProfilerListener.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,74 @@
+<?php
+
+namespace Bolt\EventListener;
+
+use Bolt\AccessControl\Token\Token;
+use Bolt\Request\ProfilerAwareTrait;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\Session\SessionInterface;
+use Symfony\Component\HttpKernel\Event\GetResponseEvent;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\HttpKernel\KernelEvents;
+
+/**
+ * Symfony Profiler listener.
+ *
+ * @author Gawain Lynch <gawain.lynch@gmail.com>
+ */
+class ProfilerListener implements EventSubscriberInterface
+{
+    use ProfilerAwareTrait;
+
+    /** @var SessionInterface */
+    private $session;
+    /** @var bool */
+    private $debug;
+    /** @var bool */
+    private $debugLoggedOff;
+
+    /**
+     * Constructor.
+     *
+     * @param SessionInterface $session
+     * @param bool             $debug
+     * @param bool             $debugLoggedOff
+     */
+    public function __construct(SessionInterface $session, $debug, $debugLoggedOff)
+    {
+        $this->session = $session;
+        $this->debug = $debug;
+        $this->debugLoggedOff = $debugLoggedOff;
+    }
+
+    /**
+     * Request listener to prevent access to profiler routes when debugging is
+     * not enabled, or the user is logged off & debugging is not configured to
+     * show when logged off.
+     *
+     * @param GetResponseEvent $event
+     */
+    public function onKernelRequest(GetResponseEvent $event)
+    {
+        $request = $event->getRequest();
+        if (!$this->isProfilerRequest($request)) {
+            return;
+        }
+
+        $token = $this->session->isStarted() ? $this->session->get('authentication') : null;
+        if ($this->debug && ($token instanceof Token || $this->debugLoggedOff)) {
+            return;
+        }
+
+        throw new NotFoundHttpException();
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public static function getSubscribedEvents()
+    {
+        return [
+            KernelEvents::REQUEST => ['onKernelRequest'],
+        ];
+    }
+}

programming_language: PHP
filename: EventListenerServiceProvider.php
change_type: ModificationType.MODIFY
diff: @@ -130,6 +130,16 @@ class EventListenerServiceProvider implements ServiceProviderInterface
                 return new Listener\ZoneGuesser($app);
             }
         );
+
+        $app['listener.profile'] = $app->share(
+            function ($app) {
+                return new Listener\ProfilerListener(
+                    $app['session'],
+                    $app['debug'],
+                    $app['config']->get('general/debug_show_loggedoff')
+                );
+            }
+        );
     }
 
     public function boot(Application $app)
@@ -160,5 +170,7 @@ class EventListenerServiceProvider implements ServiceProviderInterface
         if (isset($app['listener.exception']) && !$app['config']->get('general/debug_error_use_symfony')) {
             $dispatcher->addSubscriber($app['listener.exception']);
         }
+
+        $dispatcher->addSubscriber($app['listener.profile']);
     }
 }

programming_language: PHP