GHSA-5PGM-3J3G-2RC7

Vulnerability from github – Published: 2022-07-12 22:15 – Updated: 2022-07-19 22:31
VLAI
Summary
Valinor error messages leading to potential data exfiltration before v0.12.0
Details
<?php

namespace My\App;

use CuyZ\Valinor\Mapper\MappingError;
use CuyZ\Valinor\Mapper\Tree\Node;
use CuyZ\Valinor\Mapper\Tree\NodeTraverser;
use CuyZ\Valinor\MapperBuilder;

require_once __DIR__ . '/Valinor/vendor/autoload.php';

final class Money
{
    private function __construct(public readonly string $amount)
    {
    }

    public static function fromString(string $money): self
    {
        if (1 !== \preg_match('/^\d+ [A-Z]{3}$/', $money)) {
            throw new \InvalidArgumentException(\sprintf('Given "%s" is not a recognized monetary amount', $money));
        }

        return new self($money);
    }
}

class Foo
{
    public function __construct(
        private readonly Money $a,
        private readonly Money $b,
        private readonly Money $c,
    ) {}
}

$mapper = (new MapperBuilder())
    ->registerConstructor([Money::class, 'fromString'])
    ->mapper();

try {
    var_dump($mapper->map(Foo::class, [
        'a' => 'HAHA',
        'b' => '100 EUR',
        'c' => 'USD 100'
    ]));
} catch (MappingError $e) {
    $messages = (new NodeTraverser(function (Node $node) {
        foreach ($node->messages() as $message) {
            var_dump([
                '$message',
                $message->path(),
                $message->body()
            ]);
        }
        return '';
    }))->traverse($e->node());

    iterator_to_array($messages);
}

Now, this is quite innocent: it produces following output:

❯ php value-object-conversion.php
array(3) {
  [0]=>
  string(8) "$message"
  [1]=>
  string(1) "a"
  [2]=>
  string(48) "Given "HAHA" is not a recognized monetary amount"
}
array(3) {
  [0]=>
  string(8) "$message"
  [1]=>
  string(1) "c"
  [2]=>
  string(51) "Given "USD 100" is not a recognized monetary amount"
}

The problem is that nowhere I told valinor that it could use Throwable#getMessage().

This is a problem with cases where you get:

  • an SQL exception showing an SQL snippet
  • a DB connection exception showing DB ip address/username/password
  • a timeout detail / out of memory detail (exploring DDoS possibilities)

This allows for potential data exfiltration, DDoS, enumeration attacks, etc.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "cuyz/valinor"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31140"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-12T22:15:29Z",
    "nvd_published_at": "2022-07-11T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "```php\n\u003c?php\n\nnamespace My\\App;\n\nuse CuyZ\\Valinor\\Mapper\\MappingError;\nuse CuyZ\\Valinor\\Mapper\\Tree\\Node;\nuse CuyZ\\Valinor\\Mapper\\Tree\\NodeTraverser;\nuse CuyZ\\Valinor\\MapperBuilder;\n\nrequire_once __DIR__ . \u0027/Valinor/vendor/autoload.php\u0027;\n\nfinal class Money\n{\n    private function __construct(public readonly string $amount)\n    {\n    }\n\n    public static function fromString(string $money): self\n    {\n        if (1 !== \\preg_match(\u0027/^\\d+ [A-Z]{3}$/\u0027, $money)) {\n            throw new \\InvalidArgumentException(\\sprintf(\u0027Given \"%s\" is not a recognized monetary amount\u0027, $money));\n        }\n        \n        return new self($money);\n    }\n}\n\nclass Foo\n{\n    public function __construct(\n        private readonly Money $a,\n        private readonly Money $b,\n        private readonly Money $c,\n    ) {}\n}\n\n$mapper = (new MapperBuilder())\n    -\u003eregisterConstructor([Money::class, \u0027fromString\u0027])\n    -\u003emapper();\n\ntry {\n    var_dump($mapper-\u003emap(Foo::class, [\n        \u0027a\u0027 =\u003e \u0027HAHA\u0027,\n        \u0027b\u0027 =\u003e \u0027100 EUR\u0027,\n        \u0027c\u0027 =\u003e \u0027USD 100\u0027\n    ]));\n} catch (MappingError $e) {\n    $messages = (new NodeTraverser(function (Node $node) {\n        foreach ($node-\u003emessages() as $message) {\n            var_dump([\n                \u0027$message\u0027,\n                $message-\u003epath(),\n                $message-\u003ebody()\n            ]);\n        }\n        return \u0027\u0027;\n    }))-\u003etraverse($e-\u003enode());\n\n    iterator_to_array($messages);\n}\n```\n\nNow, this is quite innocent: it produces following output:\n\n```\n\u276f php value-object-conversion.php\narray(3) {\n  [0]=\u003e\n  string(8) \"$message\"\n  [1]=\u003e\n  string(1) \"a\"\n  [2]=\u003e\n  string(48) \"Given \"HAHA\" is not a recognized monetary amount\"\n}\narray(3) {\n  [0]=\u003e\n  string(8) \"$message\"\n  [1]=\u003e\n  string(1) \"c\"\n  [2]=\u003e\n  string(51) \"Given \"USD 100\" is not a recognized monetary amount\"\n}\n```\n\nThe problem is that nowhere I told valinor that it could use `Throwable#getMessage()`.\n\nThis is a problem with cases where you get:\n\n * an SQL exception showing an SQL snippet\n * a DB connection exception showing DB ip address/username/password\n * a timeout detail / out of memory detail (exploring DDoS possibilities)\n\nThis allows for potential data exfiltration, DDoS, enumeration attacks, etc.",
  "id": "GHSA-5pgm-3j3g-2rc7",
  "modified": "2022-07-19T22:31:41Z",
  "published": "2022-07-12T22:15:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/CuyZ/Valinor/security/advisories/GHSA-5pgm-3j3g-2rc7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31140"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/CuyZ/Valinor"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CuyZ/Valinor/releases/tag/0.12.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Valinor error messages leading to potential data exfiltration before v0.12.0"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.