CVE-2016-5702 (published 2016-07-03T01:59Z)

phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 3.7, LOW (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-254
cwe_name: 7PK - Security Features
description: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Fix information:
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Michal Čihař
author_date: 2016-06-16 09:35:56+02:00
msg: Improve detection of script name

In case PHP_SELF was not set by server, we used REQUEST_URI, which might
embed PATH_INFO as well. However we really need to know the path without
it, so let's strip it as well.

Signed-off-by: Michal Čihař <michal@cihar.com>
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: Config.php
change_type: ModificationType.MODIFY
diff: @@ -1393,11 +1393,7 @@ public function getCookiePath()
             return $cookie_path;
         }
 
-        if (isset($GLOBALS['PMA_PHP_SELF'])) {
-            $parsed_url = parse_url($GLOBALS['PMA_PHP_SELF']);
-        } else {
-            $parsed_url = parse_url(PMA_getenv('REQUEST_URI'));
-        }
+        $parsed_url = parse_url($GLOBALS['PMA_PHP_SELF']);
 
         $parts = explode(
             '/',

programming_language: PHP
filename: core.lib.php
change_type: ModificationType.MODIFY
diff: @@ -940,15 +940,20 @@ function PMA_setGlobalDbOrTable($param)
  */
 function PMA_cleanupPathInfo()
 {
-    global $PMA_PHP_SELF, $_PATH_INFO;
+    global $PMA_PHP_SELF;
 
     $PMA_PHP_SELF = PMA_getenv('PHP_SELF');
+    if (empty($PMA_PHP_SELF)) {
+        $PMA_PHP_SELF = urldecode(PMA_getenv('REQUEST_URI'));
+    }
     $_PATH_INFO = PMA_getenv('PATH_INFO');
     if (! empty($_PATH_INFO) && ! empty($PMA_PHP_SELF)) {
         $path_info_pos = mb_strrpos($PMA_PHP_SELF, $_PATH_INFO);
-        $pathLength = $path_info_pos + mb_strlen($_PATH_INFO);
-        if ($pathLength === mb_strlen($PMA_PHP_SELF)) {
-            $PMA_PHP_SELF = mb_substr($PMA_PHP_SELF, 0, $path_info_pos);
+        if ($path_info_pos !== false) {
+            $path_info_part = mb_substr($PMA_PHP_SELF, $path_info_pos, mb_strlen($_PATH_INFO));
+            if ($path_info_part == $_PATH_INFO) {
+                $PMA_PHP_SELF = mb_substr($PMA_PHP_SELF, 0, $path_info_pos);
+            }
         }
     }
     $PMA_PHP_SELF = htmlspecialchars($PMA_PHP_SELF);

programming_language: PHP
filename: PMA_cleanupPathInfo_test.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,84 @@
+<?php
+/* vim: set expandtab sw=4 ts=4 sts=4: */
+/**
+ *
+ * PMA_fatalError() displays the given error message on phpMyAdmin error page in
+ * foreign language
+ * and ends script execution and closes session
+ *
+ * @package PhpMyAdmin-test
+ */
+
+
+
+
+/**
+ *
+ * PMA_fatalError() displays the given error message on phpMyAdmin error page in
+ * foreign language
+ * and ends script execution and closes session
+ *
+ * @package PhpMyAdmin-test
+ */
+class PMA_CleanupPathInfo_Test extends PHPUnit_Framework_TestCase
+{
+    /**
+     * Test for PMA_cleanupPathInfo
+     *
+     * @param string $php_self  The PHP_SELF value
+     * @param string $request   The REQUEST_URI value
+     * @param string $path_info The PATH_INFO value
+     * @param string $expected  Expected result
+     *
+     * @return void
+     *
+     * @dataProvider pathsProvider
+     */
+    public function testPahtInfo($php_self, $request, $path_info, $expected)
+    {
+        $_SERVER['PHP_SELF'] = $php_self;
+        $_SERVER['REQUEST_URI'] = $request;
+        $_SERVER['PATH_INFO'] = $path_info;
+        PMA_cleanupPathInfo();
+        $this->assertEquals(
+            $expected,
+            $GLOBALS['PMA_PHP_SELF']
+        );
+    }
+
+    /**
+     * Data provider for PMA_cleanupPathInfo tests
+     *
+     * @return array
+     */
+    public function pathsProvider()
+    {
+        return array(
+            array(
+                '/phpmyadmin/index.php/; cookieinj=value/',
+                '/phpmyadmin/index.php/;%20cookieinj=value///',
+                '/; cookieinj=value/',
+                '/phpmyadmin/index.php'
+            ),
+            array(
+                '',
+                '/phpmyadmin/index.php/;%20cookieinj=value///',
+                '/; cookieinj=value/',
+                '/phpmyadmin/index.php'
+            ),
+            array(
+                '/phpmyadmin/index.php',
+                '/phpmyadmin/index.php',
+                '',
+                '/phpmyadmin/index.php'
+            ),
+            array(
+                '',
+                '/phpmyadmin/index.php',
+                '',
+                '/phpmyadmin/index.php'
+            ),
+        );
+    }
+}
+

programming_language: PHP