CVE-2019-19576 (published 2019-12-04T18:15Z)

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/getk2/k2
commit_details: repo_url: https://github.com/getk2/k2
author: Fotis Evangelou
author_date: 2019-12-03 21:14:08+02:00
msg: Update class.upload.php
repository: repo_url: https://github.com/getk2/k2
repo_name: getk2/k2
description: K2 - the powerful content extension for Joomla
repo_language: PHP
owner: getk2
file_changes: filename: class.upload.php
change_type: ModificationType.MODIFY
diff: @@ -2992,7 +2992,7 @@ class upload {
                 }
                 // if the file is text based, or has a dangerous extension, we rename it as .txt
                 if ((((substr($this->file_src_mime, 0, 5) == 'text/' && $this->file_src_mime != 'text/rtf') || strpos($this->file_src_mime, 'javascript') !== false)  && (substr($file_src_name, -4) != '.txt'))
-                    || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js)$/i', $this->file_src_name)
+                    || preg_match('/\.(asp|cgi|js|ph3|ph4|ph5|ph7|phar|php|php3|php4|php5|php7|phps|phtml|pl|py)$/i', $this->file_src_name)
                     || $this->file_force_extension && empty($file_src_name_ext)) {
                     $this->file_src_mime = 'text/plain';
                     if ($this->file_src_name_ext) $file_src_name_body = $file_src_name_body . '.' . $this->file_src_name_ext;

programming_language: PHP
repo_url: https://github.com/verot/class.upload.php
commit_details: repo_url: https://github.com/verot/class.upload.php
author: Colin Verot
author_date: 2019-12-04 13:34:43+01:00
msg: blacklist .phar extension
repository: repo_url: https://github.com/verot/class.upload.php
repo_name: verot/class.upload.php
description: This PHP class uploads files and manipulates images very easily. It is in fact as much as an image processing class than it is an upload class. Compatible with PHP 4, 5, 7 and 8. Supports processing of local files, uploaded files, files sent through XMLHttpRequest. 
repo_language: PHP
owner: verot
file_changes: filename: class.upload.php
change_type: ModificationType.MODIFY
diff: @@ -3065,7 +3065,7 @@ class Upload {
                 }
                 // if the file is text based, or has a dangerous extension, we rename it as .txt
                 if ((((substr($this->file_src_mime, 0, 5) == 'text/' && $this->file_src_mime != 'text/rtf') || strpos($this->file_src_mime, 'javascript') !== false)  && (substr($file_src_name, -4) != '.txt'))
-                    || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js)$/i', $this->file_src_name)
+                    || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js|phar)$/i', $this->file_src_name)
                     || $this->file_force_extension && empty($file_src_name_ext)) {
                     $this->file_src_mime = 'text/plain';
                     if ($this->file_src_name_ext) $file_src_name_body = $file_src_name_body . '.' . $this->file_src_name_ext;

programming_language: PHP