File Manipulation and Cross Site Scripting in usererror.missing_extension.php

[Xyntax]

File Manipulation

https://github.com/symphonycms/symphony-2/blob/master/symphony/template/usererror.missing_extension.php#L15

@rename(EXTENSIONS . '/' . $_POST['existing-folder'], EXTENSIONS . '/' . $_POST['new-folder']))

Data from $_POST is passed directly into filepath, attacker may control filepath with injecting ../.

Cross Site Scripting

https://github.com/symphonycms/symphony-2/blob/master/symphony/template/usererror.missing_extension.php#L18

$name = $_POST['existing-folder'];
...
Symphony::Engine()->throwCustomError(
                __('Could not find extension %s at location %s.', array(
                    '<code>' . $name . '</code>',
                    '<code>' . $path . '</code>'
                )),

Here data from $_POST to HTML allows attacker to trigger an XSS with payload llike existing-folder=</code><script>xxx</script>

[brendo]

Thank you for reporting @Xyntax.

@nitriques First might need a custom check to ensure an attacker can't traverse up (or down) in the tree. Second can be solved using filter_var IMO.

[nitriques]

Boy do I want to remove all to pesky $_ access.

[nitriques]

Thank you for reporting @Xyntax.

If you ever discover of security bugs. please follow our disclosure policy: https://github.com/symphonycms/symphony-2/wiki/Security-Bug-Disclosure

[nitriques]

@Xyntax
fbab292 fixes the XSS issue
e177fc7 fixes the path traversal issue

@brendo could you review please ?

[nitriques]

2.6.10 is out

[munki-boy]

👍 @nitriques