Security issues in Contao #6695

pedrib · 2014-01-30T14:39:59Z

Hi,

I have found a few security issues in the latest stable of contao.

Please contact me by email (pedrib@gmail.com) so that I can send the report to you.

To avoid revealing the bug before it's fixed, I will only send the report to people who have committed changed to the repository in the last 2 versions.

Regards,
Pedro

aschempp · 2014-01-30T14:41:00Z

Please send it to andreas.schempp@terminal42.ch

…#6695) Do not process serialized objects in the `deserialize()` function, so it is not vulnerable to PHP object injection in conjunction with raw POST data. Thanks to Pedro Ribeiro for his input.

leofeyer · 2014-01-31T11:27:18Z

@pedrib Thanks a lot for your input. I have removed all redundant deserialize() calls in d67c46c.

aschempp · 2014-02-03T08:18:34Z

@leofeyer looks like you did not consider the fact that people might currently use deserialize() to produce objects??

aschempp · 2014-02-03T08:19:09Z

Also, your currently implementation will not help anything if I wrap an object inside an array...

leofeyer · 2014-02-03T08:47:42Z

you did not consider the fact that people might currently use deserialize() to produce objects?

Yes, I did. But fixing potential vulnerabilities weights more than backwards compatibility.

Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.

leofeyer · 2014-02-03T09:57:15Z

I have also back-ported the changes to our old LTS branch in f939b5b.

Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.

leofeyer closed this Jan 31, 2014

leofeyer added a commit that referenced this issue Feb 3, 2014

Do not pass POST data to the `deserialize()` function (see #6695)

d67c46c

Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.

leofeyer added a commit that referenced this issue Feb 3, 2014

Do not pass POST data to the `deserialize()` function (see #6695)

7cf23d0

Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.

leofeyer added a commit that referenced this issue Feb 3, 2014

Do not pass POST data to the `deserialize()` function (see #6695)

f939b5b

Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.

discordier mentioned this issue Feb 11, 2014

Harden the core classes against unserialize() object injections. #6730

Closed

leofeyer added a commit that referenced this issue Oct 31, 2014

Do not pass POST data to the `deserialize()` function (see #6695)

92cb467

Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.

contao / core Archived

Security issues in Contao #6695

Security issues in Contao #6695

pedrib commented Jan 30, 2014

aschempp commented Jan 30, 2014

leofeyer commented Jan 31, 2014

aschempp commented Feb 3, 2014

aschempp commented Feb 3, 2014

leofeyer commented Feb 3, 2014

leofeyer commented Feb 3, 2014

contao / core Archived

Security issues in Contao #6695

Security issues in Contao #6695

Comments

pedrib commented Jan 30, 2014

aschempp commented Jan 30, 2014

leofeyer commented Jan 31, 2014

aschempp commented Feb 3, 2014

aschempp commented Feb 3, 2014

leofeyer commented Feb 3, 2014

leofeyer commented Feb 3, 2014