mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
37a6594703
`^\s*function` matched a bare declaration and nothing else, so every method
written the way modern PHP writes them -- `public function`, `protected
function`, `private static function` -- was invisible to the region model.
The effect is not subtle on class-based plugins. MW WP Form's
`class.mail.php` produced ONE file-level region spanning 272 lines instead
of 16 method-scoped ones, and its `protected function _delete_files()` --
which holds CVE-2023-6559 -- was not a region at all. Paid Memberships Pro
happened to work only because that particular file omits the modifiers.
class.mail.php 1 file-level region -> 16 method-scoped regions
Also adds the MW WP Form checkout as the PATH family's plugin, pinned at
3bdd33d (5.0.3) with CVE-2023-6559 verified in the code:
protected function _delete_files() {
foreach ( $this->attachments as $file ) {
if ( file_exists( $file ) ) {
unlink( $file );
and the fix at 02ebc67 replacing the existence check with `realpath()`,
`is_file()` and a directory-confinement test. `unlink` is a modelled path
sink and `realpath` a modelled sanitizer, so this is a pair the engine
should separate rather than merely flag -- which is what makes it worth
more than a single hit.
Gates byte-identical.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
37 lines
1.6 KiB
TOML
37 lines
1.6 KiB
TOML
# MW WP Form 5.0.3 -- a WordPress plugin with an arbitrary file deletion.
|
|
#
|
|
# The PATH family's checkout, chosen so the class-by-class table (5.8) has more than one flaw class in it.
|
|
# Verified in the code: at this commit `classes/services/class.mail.php:259` reads
|
|
#
|
|
# protected function _delete_files() {
|
|
# foreach ( $this->attachments as $file ) {
|
|
# if ( file_exists( $file ) ) {
|
|
# unlink( $file );
|
|
#
|
|
# and the fix (02ebc67, "fix Delete only attachments in MW_WP_Form_Mail_Service->_delete_files()") replaces
|
|
# the existence check with `realpath()`, `is_file()` and a confinement test against the plugin's own upload
|
|
# directory. `unlink` is a modelled path sink and `realpath` a modelled sanitizer, so this is a pair the
|
|
# engine should be able to separate rather than merely flag.
|
|
|
|
name = "mwwpform"
|
|
url = "https://github.com/inc2734/mw-wp-form.git"
|
|
commit = "3bdd33d834afe449c898b78ed6f71a57193df71b"
|
|
language = "php"
|
|
license = "GPL-2.0"
|
|
license_file = "readme.txt"
|
|
measures = ["detection"]
|
|
note = """
|
|
The parent of the fix commit; released as 5.0.3, fixed in 5.0.4 (2023-12-08). Nothing is vendored -- the
|
|
recipe fetches on request and CI never does.
|
|
"""
|
|
|
|
[[known]]
|
|
id = "CVE-2023-6559"
|
|
family = "path"
|
|
weakness = "arbitrary file deletion: an attachment path reaches unlink() behind a file_exists check that confines nothing"
|
|
file = "classes/services/class.mail.php"
|
|
function = "_delete_files"
|
|
line = 259
|
|
reference = "fixed in 02ebc67b5856787e25c357ce928b61f8e37920f4, which adds realpath(), is_file() and a directory-confinement test; the vulnerable line is verified in the checkout"
|
|
in_scope = true
|