CVE-2022-0409 (published 2022-02-19T05:15Z)

Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/star7th/showdoc
commit_details: repo_url: https://github.com/star7th/showdoc
author: star7th
author_date: 2022-01-26 20:38:00+08:00
msg: File upload vulnerability
repository: repo_url: https://github.com/star7th/showdoc
repo_name: star7th/showdoc
description: ShowDoc is a tool greatly applicable for an IT team to share documents online一个非常适合IT团队的在线API文档、技术文档工具
repo_language: JavaScript
owner: star7th
file_changes: filename: AttachmentController.class.php
change_type: ModificationType.MODIFY
diff: @@ -78,11 +78,8 @@ class AttachmentController extends BaseController {
         if (!$_FILES['editormd-image-file']) {
            return false;
         }
-        
-        if (strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".php") 
-            || strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".htm") 
-            || strstr(strip_tags(strtolower($_FILES['editormd-image-file']['name'])), ".svg") 
-            ) {
+
+        if(D("Attachment")->isDangerFilename($_FILES['editormd-image-file']['name'])){
             return false;
         }
 
@@ -111,12 +108,8 @@ class AttachmentController extends BaseController {
         if (!$uploadFile) {
            return false;
         }
-        
-        if (strstr(strip_tags(strtolower($uploadFile['name'])), ".php") 
-            || strstr(strip_tags(strtolower($uploadFile['name'])), ".htm") 
-            || strstr(strip_tags(strtolower($uploadFile['name'])), ".svg") 
-            
-            ) {
+
+        if(D("Attachment")->isDangerFilename($uploadFile['name'])){
             $this->sendError(10100,'不支持此文件类型');
             return false;
         }

programming_language: PHP
filename: AttachmentModel.class.php
change_type: ModificationType.MODIFY
diff: @@ -57,13 +57,10 @@ class AttachmentModel extends BaseModel {
 	public function upload($_files , $file_key , $uid , $item_id = 0  , $page_id = 0  ){
 		$uploadFile = $_files[$file_key] ;
 
-		if (strstr(strip_tags(strtolower($uploadFile['name'])), ".php")
-		||  strstr(strip_tags(strtolower($uploadFile['name'])), ".php")
-		||  strstr(strip_tags(strtolower($uploadFile['name'])), ".svg")
-		
-		) {
+		if($this->isDangerFilename($uploadFile['name'])){
 			return false;
-	}
+		}
+
 		$oss_open = D("Options")->get("oss_open" ) ;
 		if ($oss_open) {
 				$url = $this->uploadOss($uploadFile);
@@ -290,6 +287,27 @@ class AttachmentModel extends BaseModel {
 
 	}
 
+	// 判断文件名是否包含危险的扩展名
+	public function isDangerFilename($filename){
+
+		$isDangerStr = function ($filename , $keyword){
+			if(strstr(strip_tags(strtolower( $filename )), $keyword) ){
+				return true ;
+			}
+			return false;
+		};
+		if (
+			 $isDangerStr($filename , ".php")
+			|| $isDangerStr($filename , ".svg")
+			|| $isDangerStr($filename , ".htm")
+			|| $isDangerStr($filename , "%")
+		) {
+			return true;
+		}
+	
+		return false;
+	}
+
 
 
 }
\ No newline at end of file

programming_language: PHP