Skip to content

Commit b8332c9

Browse files
wubinworkswubinworks
authored
Merge pull request #1 from wubinworks/security/potential-security-breach-php-type
Fixed potential security breach
2 parents cd8a7bc + 086c75b commit b8332c9

File tree

4 files changed

+50
-35
lines changed

4 files changed

+50
-35
lines changed

‎Model/Escaper/Debugger.php

+5-9
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,11 @@ public function debug($input)
2828
return $this->debugArray($input);
2929
} elseif (is_object($input)) {
3030
return $this->debugObject($input);
31-
} else {
31+
} elseif (is_scalar($input) || $input === null) {
3232
return $input;
33+
} else {
34+
// phpcs:ignore Magento2.Functions.DiscouragedFunction.Discouraged
35+
return gettype($input);
3336
}
3437
}
3538

@@ -44,15 +47,8 @@ protected function debugArray(array $input): array
4447
{
4548
$result = [];
4649
foreach ($input as $key => $item) {
47-
if (is_array($item)) {
48-
$result[$key] = $this->debugArray($item);
49-
} elseif (is_object($item)) {
50-
$result[$key] = $this->debugObject($item);
51-
} else {
52-
$result[$key] = $item;
53-
}
50+
$result[$key] = $this->debug($item);
5451
}
55-
5652
return $result;
5753
}
5854

‎Model/Escaper/Filter.php

+21-17
Original file line numberDiff line numberDiff line change
@@ -87,13 +87,24 @@ protected function isProhibitedObject($obj): bool
8787
}
8888

8989
/**
90-
* Process mixed input
90+
* Check if variable is bool, int, float, null
91+
*
92+
* @param mixed $var
93+
* @return bool
94+
*/
95+
protected function isSafeType($var): bool
96+
{
97+
return !is_string($var) && (is_scalar($var) || $var === null);
98+
}
99+
100+
/**
101+
* Process mixed input. Return empty array if input is filtered
91102
*
92103
* @param mixed $input
93104
* @param string $search
94105
* @param string $replace
95106
*
96-
* @return mixed
107+
* @return mixed Possible returns include: SafeDataObject|AbstractEmailTemplate|array
97108
*/
98109
public function process($input, string $search, string $replace)
99110
{
@@ -103,8 +114,10 @@ public function process($input, string $search, string $replace)
103114
return $this->processObject($input, $search, $replace);
104115
} elseif (is_string($input)) {
105116
return $this->processString($input, $search, $replace);
106-
} else {
117+
} elseif ($this->isSafeType($input)) {
107118
return $input;
119+
} else {
120+
return [];
108121
}
109122
}
110123

@@ -121,19 +134,10 @@ protected function processArray(array $input, string $search, string $replace):
121134
{
122135
$result = [];
123136
foreach ($input as $key => $item) {
124-
if (is_string($item)) {
125-
$result[$key] = $this->processString($item, $search, $replace);
126-
} elseif (is_array($item)) {
127-
$result[$key] = $this->processArray($item, $search, $replace);
128-
} elseif (is_object($item)) {
129-
$result[$key] = $this->processObject($item, $search, $replace);
130-
} else {
131-
$result[$key] = $item;
132-
}
133-
134-
// Remove empty array
135-
if ($result[$key] === []) {
136-
unset($result[$key]);
137+
$processed = $this->process($item, $search, $replace);
138+
// Don't add empty array
139+
if ($processed !== []) {
140+
$result[$key] = $processed;
137141
}
138142
}
139143

@@ -202,7 +206,7 @@ protected function createSafeEmailTemplate($input): DataObject
202206
}
203207

204208
$data = array_filter($data, function ($value) {
205-
return is_scalar($value);
209+
return is_scalar($value) || $value === null;
206210
});
207211

208212
if (class_exists(\Magento\Framework\Filter\VariableResolver\LegacyResolver::class)

‎README.md

+16-7
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
# Magento 2 Template Filter Patch for CVE-2022-24086
1+
# Magento 2 Template Filter Patch for CVE-2022-24086, CVE-2022-24087
22

3-
**Magento 2 patch for CVE-2022-24086. Fix the RCE vulnerability and related bugs by performing deep template variable escaping. If you cannot upgrade Magento or cannot apply the official patches, try this one.**
3+
**Magento 2 patch for CVE-2022-24086, CVE-2022-24087. Fix the RCE vulnerability and related bugs by performing deep template variable escaping. If you cannot upgrade Magento or cannot apply the official patches, try this one.**
44

5-
<a href="https://www.wubinworks.com/template-filter-patch.html" target="_blank"><img src="https://raw.githubusercontent.com/wubinworks/home/master/images/Wubinworks/TemplateFilterPatch/template-filter-patch.jpg" alt="Wubinworks CVE-2022-24086 Patch" title="Wubinworks CVE-2022-24086 Patch"/></a>
5+
<a href="https://www.wubinworks.com/template-filter-patch.html" target="_blank"><img src="https://raw.githubusercontent.com/wubinworks/home/master/images/Wubinworks/TemplateFilterPatch/template-filter-patch.jpg" alt="Wubinworks CVE-2022-24086 CVE-2022-24087 Patch" title="Wubinworks CVE-2022-24086 CVE-2022-24087 Patch"/></a>
66

77
## Background
88

9-
[CVE-2022-24086](https://nvd.nist.gov/vuln/detail/cve-2022-24086) was discovered in the beginning of 2022. For Magento 2.4 releases, all versions <= 2.4.3-p1 are affected by this Remote Code Execution(RCE) vulnerability. 2 [official isolated patches](https://helpx.adobe.com/security/products/magento/apsb22-12.html) were released on February 2022.
9+
[CVE-2022-24086, CVE-2022-24087](https://nvd.nist.gov/vuln/detail/cve-2022-24086) was discovered in the beginning of 2022. For Magento 2.4 releases, all versions <= 2.4.3-p1 are affected by this Remote Code Execution(RCE) vulnerability. 2 [official isolated patches](https://helpx.adobe.com/security/products/magento/apsb22-12.html) were released on February 2022.
1010

1111
However, even in late 2024, we are still receiving consultations regarding this issue and their hacked stores were identified that this vulnerability was exploited. Most observed attacks were performed by inputting a string that contains `template directive`.
1212

@@ -29,28 +29,35 @@ Although the [official documentation](https://web.archive.org/web/20220710211400
2929
This patch(extension) also keeps the above features. So `{{var data_object.something}}` and `{{var data_object.getSomething()}}` are both OK and equivalent.
3030

3131
`getUrl` example:
32+
3233
```
3334
{{var this.getUrl($store,'route_id/controller/action',[_query:[param1:$obj.param1,param2:$obj.param2],_nosid:1])}}
3435
```
3536

3637
**In summary, after installing this extension:**
38+
3739
- Objects which are not `\Magento\Framework\DataObject` or its child instance cannot be accessed
3840
- Only "Getter" methods are allowed on `\Magento\Framework\DataObject` and its child instances
3941
- `getUrl` method is only working on `this`
4042

41-
4243
## Technical Info
4344

4445
### Official Approach
4546

4647
##### >=2.4.3-p2
48+
4749
Removed `LegacyResolver` to stop the RCE.
50+
4851
##### >=2.4.4-p2 || >=2.4.5-p1
52+
4953
Introduced "deferred directive with signature" for child template. We are unsure if it has any security enhancement.
54+
5055
##### Latest(2.4.7-p3)
56+
5157
Still has an unfixed bug([#39353](https://github.com/magento/magento2/issues/39353)).
5258

5359
### Our Approach
60+
5461
Use "deep template variable escaping" before the template filtering process. `LegacyResolver` will only receive escaped user data and hence can be kept.
5562

5663
# Requirements
@@ -62,6 +69,8 @@ Use "deep template variable escaping" before the template filtering process. `Le
6269
**`composer require wubinworks/module-template-filter-patch`**
6370

6471
## ♥
65-
If you like this extension please star this repository.
6672

67-
You may also like: [Magento 2 patch for CVE-2024-34102(aka CosmicSting)](https://github.com/wubinworks/magento2-cosmic-sting-patch)
73+
If you like this extension or this extension helped you, please ★star☆ this repository.
74+
75+
You may also like:
76+
[Magento 2 patch for CVE-2024-34102(aka CosmicSting)](https://github.com/wubinworks/magento2-cosmic-sting-patch)

‎composer.json

+8-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
{
22
"name": "wubinworks/module-template-filter-patch",
3-
"description": "Magento 2 patch for CVE-2022-24086. Fix the RCE vulnerability and related bugs by performing deep template variable escaping. If you cannot upgrade Magento or cannot apply the official patches, try this one.",
3+
"description": "Magento 2 patch for CVE-2022-24086, CVE-2022-24087. Fix the RCE vulnerability and related bugs by performing deep template variable escaping. If you cannot upgrade Magento or cannot apply the official patches, try this one.",
44
"keywords": [
55
"cve-2022-24086",
6+
"cve-2022-24087",
67
"rce",
78
"magento 2",
89
"email template",
@@ -15,12 +16,17 @@
1516
"deep escape",
1617
"legacyresolver"
1718
],
19+
"homepage": "https://www.wubinworks.com",
20+
"support": {
21+
"issues": "https://github.com/wubinworks/magento2-template-filter-patch/issues",
22+
"chat": "https://www.wubinworks.com/contact"
23+
},
1824
"require": {
1925
"php": ">=7.3",
2026
"magento/magento2-base": "~2.4.0"
2127
},
2228
"type": "magento2-module",
23-
"version": "1.0.0",
29+
"version": "1.0.1",
2430
"license": "OSL-3.0",
2531
"authors": [
2632
{

0 commit comments

Comments
 (0)