CVE-2021-41714 (published 2022-05-23T16:16Z)

In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-494
cwe_name: Download of Code Without Integrity Check
description: The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
extended_description: An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.
         

Fix information:
repo_url: https://github.com/sdfsky/tipask
commit_details: repo_url: https://github.com/sdfsky/tipask
author: songdengfeng
author_date: 2021-09-17 11:10:54+08:00
msg: 文件下载漏洞修正
repository: repo_url: https://github.com/sdfsky/tipask
repo_name: sdfsky/tipask
description: Tipask是一款开放源码的PHP问答系统，基于Laravel框架开发，容易扩展，具有强大的负载能力和稳定性。
repo_language: JavaScript
owner: sdfsky
file_changes: filename: AttachController.php
change_type: ModificationType.MODIFY
diff: @@ -39,7 +39,8 @@ class AttachController extends Controller
 
 
     public function download($name){
-        $attachFile = storage_path('app/'.str_replace("-","/",$name));
+        $fileName = str_replace("..","",$name);
+        $attachFile = storage_path('app/'.str_replace("-","/",$fileName));
         if(!is_file($attachFile)){
             abort(404);
         }
@@ -48,4 +49,4 @@ class AttachController extends Controller
 
 
 
-}
\ No newline at end of file
+}

programming_language: PHP
filename: ImageController.php
change_type: ModificationType.MODIFY
diff: @@ -20,7 +20,9 @@ class ImageController extends Controller
      */
     public function avatar($avatar_name)
     {
-        list($user_id,$size) = explode('_',str_replace(".jpg",'',$avatar_name));
+        $fileName = str_replace("..","",$avatar_name);
+
+        list($user_id,$size) = explode('_',str_replace(".jpg",'',$fileName));
         $avatarFile = storage_path('app/'.User::getAvatarPath($user_id,$size));
         if(!is_file($avatarFile)){
             $avatarFile = public_path('static/images/default_avatar.jpg');
@@ -38,7 +40,9 @@ class ImageController extends Controller
 
     public function show($image_name)
     {
-        $imageFile = storage_path('app/'.str_replace("-","/",$image_name));
+        $fileName = str_replace("..","",$image_name);
+
+        $imageFile = storage_path('app/'.str_replace("-","/",$fileName));
         if(!is_file($imageFile)){
             abort(404);
         }
@@ -46,7 +50,7 @@ class ImageController extends Controller
 
         $image =   Image::make($imageFile);
 
-        if(config('tipask.upload.open_watermark') && $image_name != config('tipask.upload.watermark_image') && str_contains($image_name,'attachments')){
+        if(config('tipask.upload.open_watermark') && $fileName != config('tipask.upload.watermark_image') && str_contains($fileName,'attachments')){
             $watermarkImage = storage_path('app/'.str_replace("-","/",config('tipask.upload.watermark_image')));
             $image->insert($watermarkImage, 'bottom-right', 15, 10);
         }

programming_language: PHP