diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml new file mode 100644 index 0000000..4d0d288 --- /dev/null +++ b/.github/workflows/osv-scanner.yml @@ -0,0 +1,18 @@ +name: OSV-Scanner PR Scan + +# Change "main" to your default branch if you use a different name, i.e. "master" +on: + pull_request: + branches: [master] + merge_group: + branches: [master] + +permissions: + # Require writing security events to upload SARIF file to security tab + security-events: write + # Only need to read contents + contents: read + +jobs: + scan-pr: + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v1.6.2-beta1" diff --git a/CVE-2015-8562.php b/CVE-2015-8562.php new file mode 100644 index 0000000..e21865c --- /dev/null +++ b/CVE-2015-8562.php @@ -0,0 +1,107 @@ +// https://voidsec.com/analysis-of-the-joomla-rce-cve-2015-8562/ + + + +// Check for clients browser +if (in_array('fix_browser', $this->security) && isset($_SERVER['HTTP_USER_AGENT'])){ + $browser = $this->get('session.client.browser'); + + if ($browser === null){ + $this->set('session.client.browser', $_SERVER['HTTP_USER_AGENT']); + } + elseif ($_SERVER['HTTP_USER_AGENT'] !== $browser) { + // @todo remove code: $this->_state = 'error'; + // @todo remove code: return false; + } +} + +joomla_session` VALUES ('02di8ph9l9on7aa905khshtu57',0,1,'1505489800', +'__default|a:8:{ + s:15:"session.counter"; i:1; + s:19:"session.timer.start"; i:1505489800; + s:18:"session.timer.last"; i:1505489800; + s:17:"session.timer.now"; i:1505489800; + s:22:"session.client.browser"; s:11:"curl/7.55.1"; + s:8:"registry"; + O:9:"JRegistry":1:{ + s:7:"\0\0\0data"; + O:8:"stdClass":0:{} + } + s:4:"user";O:5:"JUser":24:{ + s:9:"\0\0\0isRoot"; b:0; + s:2:"id"; i:0; + s:4:"name"; N; + s:8:"username"; N; + s:5:"email"; N; + s:8:"password"; N; + s:14:"password_clear"; s:0:""; + s:5:"block"; N; + s:9:"sendEmail"; i:0; + s:12:"registerDate"; N; + s:13:"lastvisitDate"; N; + s:10:"activation"; N; + s:6:"params"; N; + s:6:"groups"; + a:1:{ + i:0; + s:2:"13"; + } + s:5:"guest"; i:1; + s:13:"lastResetTime"; N; + s:10:"resetCount"; N; + s:10:"\0\0\0_params"; + O:9:"JRegistry":1:{ + s:7:"\0\0\0data"; + O:8:"stdClass":0:{} + } + s:14:"\0\0\0_authGroups"; + a:1:{ + i:0; + s:1:"1"; + } + s:14:"\0\0\0_authLevels"; + a:2:{ + i:0; + i:1; + i:1; + i:1; + } + s:15:"\0\0\0_authActions"; N; + s:12:"\0\0\0_errorMsg"; N; + s:10:"\0\0\0_errors"; a:0:{} + s:3:"aid"; i:0; + } + s:13:"session.token"; s:32:"ead9d16586b72de83eab1761e20436e4"; +}' +,0,''); + + + +public function write($id, $data) +{ + // Get the database connection object and verify its connected. + $db = JFactory::getDbo(); + $data = str_replace(chr(0) . '*' . chr(0), '\0\0\0', $data); + try { + $query = $db->getQuery(true) + ->update($db->quoteName('#__session')) + ->set($db->quoteName('data') . ' = ' . $db->quote($data)) + ->set($db->quoteName('time') . ' = ' . $db->quote((int) time())) + ->where($db->quoteName('session_id') . ' = ' . $db->quote($id)); + + // Try to update the session data in the database table. + $db->setQuery($query); + + if (!$db->;execute()) { + return false; + } + /* Since $db->execute did not throw an exception, so the query was successful. + Either the data changed, or the data was identical. + In either case we are done. + */ + return true; + } + catch (Exception $e) { + return false; + } +} diff --git a/CVE-2019-1937 b/CVE-2019-1937 new file mode 100644 index 0000000..97950a0 --- /dev/null +++ b/CVE-2019-1937 @@ -0,0 +1,61 @@ + + public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) { + (...) + httpRequest = (HttpServletRequest)request; + logger.debug("doFilter url: " + httpRequest.getRequestURL().toString()); + boolean isAuthenticated = this.authenticateUser(httpRequest); + ^^^ 1.5) invokes authenticateUser() (function shown below) + + String samlLogoutRequest; + if(!isAuthenticated) { + ^^^ 1.6) if authenticateUser() returns false, we go into this branch + + samlLogoutRequest = request.getParameter("SAMLResponse"); + logger.info("samlResponse-->" + samlLogoutRequest); + if(samlLogoutRequest != null) { + this.handleSAMLReponse(request, response, chain, samlLogoutRequest); + } else { + ^^^ 1.7) if there is no SAMLResponse HTTP parameter, we go into this branch + + HttpSession session; + ProductAccess userBean; + String requestedUri; + if(this.isStarshipRequest(httpRequest)) { + ^^^ 1.8) checks if isStarshipRequest() returns true (function shown below) + + session = null != httpRequest.getSession(false)?httpRequest.getSession(false):httpRequest.getSession(true); + userBean = (ProductAccess)session.getAttribute("USER_IN_SESSION"); + if(userBean == null) { + ^^^ 1.9) if there is no session server side for this request, follow into this branch... + + try { + userBean = new ProductAccess(); + userBean.setCredentialId(""); + userBean.setAdminPasswordReset(true); + userBean.setProductId("cloupia_service_portal"); + userBean.setProfileId(0); + userBean.setRestKey(httpRequest.getHeader("X-Starship-Request-Key")); + userBean.setStarshipUserId(httpRequest.getHeader("X-Starship-UserName-Key")); + userBean.setLoginName("admin"); + ^^^ 1.10) and create a new session with the user as "admin"! + + userBean.setStarshipSessionId(httpRequest.getHeader("X-Starship-UserSession-Key")); + requestedUri = httpRequest.getHeader("X-Starship-UserRoles-Key"); + userBean.setAccessLevel(requestedUri); + if(requestedUri != null && requestedUri.equalsIgnoreCase("admin")) { + AuthenticationManager authmgr = AuthenticationManager.getInstance(); + userBean.setAccessLevel("Admin"); + authmgr.evaluateAllowedOperations(userBean); + } + + session.setAttribute("USER_IN_SESSION", userBean); + session.setAttribute("DEFAULT_URL", STARSHIP_DEFAULT_URL); + logger.info("userBean:" + userBean.getAccessLevel()); + } catch (Exception var12) { + logger.info("username/password wrong for rest api access - " + var12.getMessage()); + } + + logger.info("userBean: " + userBean.getAccessLevel()); + } + + chain.doFilter(request, response); diff --git a/cross-site-scripting-xss.php b/cross-site-scripting-xss.php new file mode 100644 index 0000000..ad2a807 --- /dev/null +++ b/cross-site-scripting-xss.php @@ -0,0 +1,24 @@ +