Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #10118 Remote code execution through object unserialization of a user's recent elements
    Actions
    Infos
    #10118
    Thomas Gerbet (tgerbet)
    2017-04-28 23:20
    2017-04-03 15:37
    10398
    Details
    Remote code execution through object unserialization of a user's recent elements

    A remote code execution can be achieved  by any user by setting a well crafted user's preference.

    Impact

    An attacker could use this vulnerability to execute code on the server as the codendiadm user.
    CVSSv3 score: 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

    Exploitation

    The method User::getRecentsElements() is using unserialize() on data that can be arbitrarily manipulated by a user through the REST API leading to an object injection.

    You can find attached a proof of concept to demonstrate the vulnerability.

    References

    The CVE ID CVE-2017-7411 has been attributed to this vulnerability.

    https://cwe.mitre.org/data/definitions/502.html
    https://www.owasp.org/index.php/PHP_Object_Injection

    Credit

    Thank you to Egidio Romano from Karma(In)Security to report and coordinate with us the disclosure of this vulnerability.

    Other
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2017-04-19
    Attachments
    Artifact links

    Releases

    Fixed in

    Artifact ID Project Tracker Summary Status Last Update Date Submitted By Assigned to
    rel #10042 Tuleap Releases 9.7 Delivered 2017-04-27 15:37 Manuel Vacelet (vaceletm)
    By Thomas Gerbet (tgerbet)
    (2 kB)
    poc.php
    References
    Referencing request #10118

    Artifact Tracker v5

    request #10149 Modifying an artifact without doing any changes throws a fatal error

    Git commit

    tuleap/tuleap/stable

    Merge commit 'refs/changes/82/8082/5' of ssh://gerrit.tuleap.net:29418/tuleap into stable c430320f57
    User avatar Nicolas Terray (nterray) , 2017-04-05 11:28
    request #10118: Remote code execution through object unserialization of a user's recent elements f140d26eb5
    User avatar Thomas Gerbet (tgerbet) , 2017-04-05 10:37
    Remove the cookies used by PHPWiki 689f824820
    User avatar Thomas Gerbet (tgerbet) , 2017-04-05 21:51
    Remove the usage of unserialize() for the user's feedbacks 9f7e4072b6
    User avatar Thomas Gerbet (tgerbet) , 2017-04-05 15:04
    Do not try anymore to open the non existing dump config file of PHPWiki adf5e6a24f
    User avatar Thomas Gerbet (tgerbet) , 2017-04-06 10:20
    Remove unused cache code in PHPWiki 37e1fcef1e
    User avatar Thomas Gerbet (tgerbet) , 2017-04-11 16:17
    Display settings

    Follow-ups

    User avatar
    Yannis ROSSETTO (rossettoy)2017-04-19 10:47
    PHPWiki part integrated into 9.6.99.90
    • Status changed from Under implementation to Closed
    • Connected artifacts
    • Close date set to 2017-04-19
    User avatar
    Thomas Gerbet (tgerbet)2017-04-12 11:31
    Updating the PoC, having a usable POP chain is not necessary to demonstrate the vulnerability.
    • Attachments poc.php removed; poc.php added
    User avatar
    Thomas Gerbet (tgerbet)2017-04-04 15:51
    In order to fix the issue and to ensure we do not have a similar issue elsewhere, I intend to go through the whole Tuleap codebase to remove all the unserialize() usage or at the bare minimum be fairly certain we do not unserialize data that can be arbitrarily manipulated.

    A first look show usages in:
    * User::getMostRecents() (which is the origin of the reported vulnerablity)
    * Feedback's responses
    * SimplePie library
    * PHPWiki

    A fix for the initial vulnerability is available here: gerrit #8082.
    User avatar
    Thomas Gerbet (tgerbet)2017-04-04 15:36
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    User avatar
    Thomas Gerbet (tgerbet)2017-04-04 15:33
    Add credits, CVE ID and the proof of concept code provided by the reporter.
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    • Status changed from Verified to Under implementation