mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 20:19:29 +00:00
37 lines
1.6 KiB
TOML
37 lines
1.6 KiB
TOML
|
# MW WP Form 5.0.3 -- a WordPress plugin with an arbitrary file deletion.
|
||
|
|
#
|
||
|
|
# The PATH family's checkout, chosen so the class-by-class table (5.8) has more than one flaw class in it.
|
||
|
|
# Verified in the code: at this commit `classes/services/class.mail.php:259` reads
|
||
|
|
#
|
||
|
|
# protected function _delete_files() {
|
||
|
|
# foreach ( $this->attachments as $file ) {
|
||
|
|
# if ( file_exists( $file ) ) {
|
||
|
|
# unlink( $file );
|
||
|
|
#
|
||
|
|
# and the fix (02ebc67, "fix Delete only attachments in MW_WP_Form_Mail_Service->_delete_files()") replaces
|
||
|
|
# the existence check with `realpath()`, `is_file()` and a confinement test against the plugin's own upload
|
||
|
|
# directory. `unlink` is a modelled path sink and `realpath` a modelled sanitizer, so this is a pair the
|
||
|
|
# engine should be able to separate rather than merely flag.
|
||
|
|
|
||
|
|
name = "mwwpform"
|
||
|
|
url = "https://github.com/inc2734/mw-wp-form.git"
|
||
|
|
commit = "3bdd33d834afe449c898b78ed6f71a57193df71b"
|
||
|
|
language = "php"
|
||
|
|
license = "GPL-2.0"
|
||
|
|
license_file = "readme.txt"
|
||
|
|
measures = ["detection"]
|
||
|
|
note = """
|
||
|
|
The parent of the fix commit; released as 5.0.3, fixed in 5.0.4 (2023-12-08). Nothing is vendored -- the
|
||
|
|
recipe fetches on request and CI never does.
|
||
|
|
"""
|
||
|
|
|
||
|
|
[[known]]
|
||
|
|
id = "CVE-2023-6559"
|
||
|
|
family = "path"
|
||
|
|
weakness = "arbitrary file deletion: an attachment path reaches unlink() behind a file_exists check that confines nothing"
|
||
|
|
file = "classes/services/class.mail.php"
|
||
|
|
function = "_delete_files"
|
||
|
|
line = 259
|
||
|
|
reference = "fixed in 02ebc67b5856787e25c357ce928b61f8e37920f4, which adds realpath(), is_file() and a directory-confinement test; the vulnerable line is verified in the checkout"
|
||
|
|
in_scope = true
|