An incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories.
This problem is fixed in LORIS 27.0.3 and 28.0.1.
diff --git a/modules/document_repository/php/files.class.inc b/modules/document_repository/php/files.class.inc
index 522ea112f..f298098a6 100644
--- a/modules/document_repository/php/files.class.inc
+++ b/modules/document_repository/php/files.class.inc
@@ -87,7 +87,7 @@ class Files extends \NDB_Page
$filename = explode(
'Files',
- urldecode($request->getUri()->getPath())
+ $request->getUri()->getPath()
)[1];
$downloader = new \LORIS\FilesDownloadHandler(
diff --git a/modules/electrophysiology_uploader/php/upload.class.inc b/modules/electrophysiology_uploader/php/upload.class.inc
index 28dad3ec6..bfce104d2 100644
--- a/modules/electrophysiology_uploader/php/upload.class.inc
+++ b/modules/electrophysiology_uploader/php/upload.class.inc
@@ -88,20 +88,15 @@ class Upload extends \NDB_Page
);
}
- $filename = urldecode(basename($file));
- $pos = strrpos($file, '/');
- $file_rel_path = $pos === false ? '' : substr($file, 0, $pos);
- $config = \NDB_Config::singleton();
- $upload_dir = new \SplFileInfo(
- $config->getSetting('EEGUploadIncomingPath')
- );
+ $config = \NDB_Config::singleton();
+ $upload_dir = $config->getSetting('EEGUploadIncomingPath');
$downloader = new \LORIS\FilesDownloadHandler(
- new \SPLFileInfo($upload_dir . '/' . $file_rel_path)
+ new \SPLFileInfo($upload_dir)
);
return $downloader->handle(
- $request->withAttribute('filename', $filename)
+ $request->withAttribute('filename', $file)
);
}
diff --git a/php/libraries/FilesDownloadHandler.php b/php/libraries/FilesDownloadHandler.php
index fdae9605a..a9ec50d4a 100644
--- a/php/libraries/FilesDownloadHandler.php
+++ b/php/libraries/FilesDownloadHandler.php
@@ -76,7 +76,7 @@ class FilesDownloadHandler implements RequestHandlerInterface
}
assert(is_string($filename) || $filename instanceof \Stringable);
- $filename = urldecode(\Utility::resolvePath(strval($filename)));
+ $filename = \Utility::resolvePath(urldecode(strval($filename)));
$targetPath = \Utility::appendForwardSlash(
$this->downloadDirectory->getPathname()
LORIS projects should upgrade to a patch version but if they can not can either apply the advisory's patch or disable all modules affected.
This vulnerability was discovered and reported by the the Ministère de la Cybersécurité et du Numérique.
Impact
An incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories.
Patches
This problem is fixed in LORIS 27.0.3 and 28.0.1.
LORIS Modules Affected
Workarounds
LORIS projects should upgrade to a patch version but if they can not can either apply the advisory's patch or disable all modules affected.
Credits
This vulnerability was discovered and reported by the the Ministère de la Cybersécurité et du Numérique.