OpenPNE 3.8.9 PHP Object Injection Vulnerability

OpenPNE <= 3.8.9 (opSecurityUser.class.php) PHP Object Injection Vulnerability

• Software Link:

http://www.openpne.jp/

• Affected Versions:

All versions from 3.6.0 to 3.6.13.
All versions from 3.8.0 to 3.8.9.

• Vulnerability Description:

The vulnerable code is located in the getRememberLoginCookie() method defined in /lib/user/opSecurityUser.class.php:
145
146
147
148
149
150
151
152
153
154
	
protected function getRememberLoginCookie()
{
  $key = md5(sfContext::getInstance()->getRequest()->getHost());
  if ($value = sfContext::getInstance()->getRequest()->getCookie($key))
  {
    $value = unserialize(base64_decode($value));
 
    return $value;
  }
}

User input passed through cookies is not properly sanitized before being used in an unserialize() call at line 150. This could be exploited to delete arbitrary files or execute arbitrary PHP code via specially crafted serialized objects sent in a “Cookie” header.

• Solution:

Update to version 3.6.13.1 or 3.8.9.1.

• Disclosure Timeline:

[20/11/2013] – Vendor notified
[16/12/2013] – Vendor acknowledges report and states fixed releases planned for January 2014
[27/12/2013] – Vendor creates patches and states fixed releases planned for January 20, 2014
[08/01/2014] – Vulnerability details sent to IPA Security Center
[20/01/2014] – Vendor released fixed versions
[20/01/2014] – Public disclosure

• CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-5350 to this vulnerability.

#  0day.today [2018-03-12]  #