Skip to content
This repository has been archived by the owner. It is now read-only.

Security issues in Contao #6695

Closed
pedrib opened this issue Jan 30, 2014 · 6 comments
Closed

Security issues in Contao #6695

pedrib opened this issue Jan 30, 2014 · 6 comments
Labels
Milestone

Comments

@pedrib
Copy link

@pedrib pedrib commented Jan 30, 2014

Hi,

I have found a few security issues in the latest stable of contao.

Please contact me by email (pedrib@gmail.com) so that I can send the report to you.

To avoid revealing the bug before it's fixed, I will only send the report to people who have committed changed to the repository in the last 2 versions.

Regards,
Pedro

@aschempp
Copy link
Member

@aschempp aschempp commented Jan 30, 2014

Please send it to andreas.schempp@terminal42.ch

leofeyer added a commit that referenced this issue Jan 31, 2014
…#6695)

Do not process serialized objects in the `deserialize()` function, so it is not vulnerable to PHP object injection in conjunction with raw POST data. Thanks to Pedro Ribeiro for his input.
@leofeyer
Copy link
Member

@leofeyer leofeyer commented Jan 31, 2014

@pedrib Thanks a lot for your input. I have removed all redundant deserialize() calls in d67c46c.

@leofeyer leofeyer closed this Jan 31, 2014
@aschempp
Copy link
Member

@aschempp aschempp commented Feb 3, 2014

@leofeyer looks like you did not consider the fact that people might currently use deserialize() to produce objects??

@aschempp
Copy link
Member

@aschempp aschempp commented Feb 3, 2014

Also, your currently implementation will not help anything if I wrap an object inside an array...

@leofeyer
Copy link
Member

@leofeyer leofeyer commented Feb 3, 2014

you did not consider the fact that people might currently use deserialize() to produce objects?

Yes, I did. But fixing potential vulnerabilities weights more than backwards compatibility.

leofeyer added a commit that referenced this issue Feb 3, 2014
Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.
leofeyer added a commit that referenced this issue Feb 3, 2014
Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.
leofeyer added a commit that referenced this issue Feb 3, 2014
Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.
@leofeyer
Copy link
Member

@leofeyer leofeyer commented Feb 3, 2014

I have also back-ported the changes to our old LTS branch in f939b5b.

leofeyer added a commit that referenced this issue Oct 31, 2014
Do not pass POST data to the `deserialize()` function, so it is not vulnerable to PHP object injection. Thanks to Pedro Ribeiro for his input.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants