{"id":17525,"date":"2021-11-30T13:16:01","date_gmt":"2021-11-30T12:16:01","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=17525"},"modified":"2022-01-12T16:34:45","modified_gmt":"2022-01-12T15:34:45","slug":"usd-2021-0006","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2021-0006\/","title":{"rendered":"usd-2021-0006"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.13.1\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

usd-2021-0006 | ChronoEngine ChronoForms v7<\/h1>\n

Advisory ID<\/strong>: usd20210006
CVE Number<\/strong>: CVE-2021-28376
Affected Product<\/strong>: ChronoEngine ChronoForms v7
Affected Version<\/strong>: v7.0.7
Vulnerability Type<\/strong>: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Security Risk<\/strong>: Medium
Vendor URL<\/strong>: https:\/\/www.chronoengine.com\/chronoforms<\/a>
Vendor Status<\/strong>: Unknown<\/p>\n

<\/span><\/p>\n

Description<\/h3>\n

The ChronoForms function to download form input logs is vulnerable through path traversal attacks. This allows an attacker with administration permissions to download arbitrary files from web servers filesystem.<\/p>\n

The parameter `fname` passed to the log script in the Joomla administration interface is not filtered for path traversal. This allows an attacker with administration permissions to download arbitrary files from the web servers filesystem, like for instance Joomla's configuration file containing secret credentials.<\/p>\n

 <\/p>\n

Vulnerable Code:
File<\/strong>: com_chronoforms7\/admin\/chronoforms\/controllers\/logs.php<\/em><\/h5>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.13.1\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" global_colors_info=\"{}\"]<\/p>\n

function file(){
$path = $this->get('cf_settings.upload.path').$this->data('fname');
\\G3\\L\\Download::send($path, 'D', basename($path));
}<\/div>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.13.1\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n

The corresponding function send($path, $view = 'D', $filename = '', $cache = false)<\/strong> in cegcore2\/libs\/download.php<\/em>.<\/p>\n

Proof of Concept (PoC)<\/h3>\n

The following steps need to be performed to exploit this issue.<\/p>\n

 <\/p>\n

Preparation:<\/h4>\n