CVE-2020-36642 (published 2023-01-06T11:15Z)

A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is able to address this issue. The identifier of the patch is 8f43daf50c943b98eaf0c542da901a4a16e85b02. It is recommended to upgrade the affected component. The identifier VDB-217553 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/trampgeek/jobe
commit_details: repo_url: https://github.com/trampgeek/jobe
author: Richard Lobb
author_date: 2020-11-20 14:39:27+13:00
msg: Prevent command injection attacks via the cputime parameter. Fixes
issue #39 (https://github.com/trampgeek/jobe/issues/39).
Thanks Marlon (myxxl).
repository: repo_url: https://github.com/trampgeek/jobe
repo_name: trampgeek/jobe
description: jobe is a server that runs small programming jobs in a variety of programming languages
repo_language: PHP
owner: trampgeek
file_changes: filename: LanguageTask.php
change_type: ModificationType.MODIFY
diff: @@ -324,17 +324,25 @@ abstract class Task {
 
     /*
      * Get the value of the job parameter $key, which is taken from the
-     * value copied into $this from the run request if present of from the
+     * value copied into $this from the run request if present or from the
      * system defaults otherwise.
+     * If a non-numeric value is provided for a parameter that has a numeric
+     * default, the default is used instead. This prevents command injection
+     * as per issue #39 (https://github.com/trampgeek/jobe/issues/39). Thanks
+     * Marlon (myxl).
      * If $iscompile is true and the parameter value is less than that specified
      * in $min_params_compile (except if it's 0 meaning no limit), the minimum
      * value is used instead.
      */
     protected function getParam($key, $iscompile=false) {
+        $default = $this->default_params[$key];
         if (isset($this->params) && array_key_exists($key, $this->params)) {
             $param = $this->params[$key];
+            if (is_numeric($default) && !is_numeric($param)) {
+                $param = $default; // Prevent command injection attacks.
+            }
         } else {
-            $param = $this->default_params[$key];
+            $param = $default;
         }
         // ** BUG ** The min_params_compile value is being applied even if
         // this is not a compile. I'm reluctant to fix, however, as it may
@@ -347,6 +355,7 @@ abstract class Task {
     }
 
 
+    
     // Check if PHP exec environment includes a PATH. If not, set up a
     // default, or gcc misbehaves. [Thanks to Binoj D for this bug fix,
     // needed on his CentOS system.]

programming_language: PHP