OpenPNE <= 3.8.9 (opSecurityUser.class.php) PHP Object Injection Vulnerability
Software Link:
http://www.openpne.jp/
Affected Versions:
All versions from 3.6.0 to 3.6.13.
All versions from 3.8.0 to 3.8.9.
Vulnerability Description:
The vulnerable code is located in the getRememberLoginCookie() method defined in /lib/user/opSecurityUser.class.php:
protected function getRememberLoginCookie()
{
$key = md5(sfContext::getInstance()->getRequest()->getHost());
if ($value = sfContext::getInstance()->getRequest()->getCookie($key))
{
$value = unserialize(base64_decode($value));
return $value;
}
}
User input passed through cookies is not properly sanitized before being used in an unserialize() call at line 150. This could be exploited to delete arbitrary files or execute arbitrary PHP code via specially crafted serialized objects sent in a “Cookie” header.
Solution:
Update to version 3.6.13.1 or 3.8.9.1.
Disclosure Timeline:
[20/11/2013] Vendor notified
[16/12/2013] Vendor acknowledges report and states fixed releases planned for January 2014
[27/12/2013] Vendor creates patches and states fixed releases planned for January 20, 2014
[08/01/2014] Vulnerability details sent to IPA Security Center
[20/01/2014] Vendor released fixed versions
[20/01/2014] Public disclosure
CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2013-5350 to this vulnerability.
