OpenPNE <= 3.8.9 (opSecurityUser.class.php) PHP Object Injection Vulnerability
• Software Link:
• Affected Versions:
All versions from 3.6.0 to 3.6.13.
All versions from 3.8.0 to 3.8.9.
• Vulnerability Description:
The vulnerable code is located in the getRememberLoginCookie() method defined in /lib/user/opSecurityUser.class.php:
145protected function getRememberLoginCookie()
146{
147 $key = md5(sfContext::getInstance()->getRequest()->getHost());
148 if ($value = sfContext::getInstance()->getRequest()->getCookie($key))
149 {
150 $value = unserialize(base64_decode($value));
151
152 return $value;
153 }
154}User input passed through cookies is not properly sanitized before being used in an unserialize() call at line 150. This could be exploited to delete arbitrary files or execute arbitrary PHP code via specially crafted serialized objects sent in a “Cookie” header.
• Solution:
Update to version 3.6.13.1 or 3.8.9.1.
• Disclosure Timeline:
[20/11/2013] – Vendor notified
[16/12/2013] – Vendor acknowledges report and states fixed releases planned for January 2014
[27/12/2013] – Vendor creates patches and states fixed releases planned for January 20, 2014
[08/01/2014] – Vulnerability details sent to IPA Security Center
[20/01/2014] – Vendor released fixed versions
[20/01/2014] – Public disclosure
• CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-5350 to this vulnerability.
• Credits:
Vulnerability discovered by Egidio Romano, Secunia Research.