Exponentcms Exponent CMS → 2.3.7

Comments and changes to this ticket

• 

  dleffler December 26th, 2015 @ 05:59 AM

  • Milestone set to “2.3.7”

  [bulk edit]

• 

  dleffler December 26th, 2015 @ 06:05 AM

  • Tag set to “security”
  • Assigned user changed from “expNinja” to “dleffler”

  This issue may have been resolved with the fix to #1320 CVE-2015-8667 which was included in the v2.3.6 release today. Additional testing will need to be performed on v2.3.6 to see if this issue still exists.

• 

  dleffler December 26th, 2015 @ 05:49 PM

  Basically there are two issues here

  1. Our .htaccess settings were a little too loose as they didn't prevent uploaded .html files from being executed
     
  2. The elFinder file manager allows opening all file types regardless of the .htaccess settings, which is further compounded when not using the file manager from within a text editor and double-clicking a file opens it

  These issues will be fixed in the next release, 1) we are blocking more filetypes and 2) we are preventing ANY files (except folders) from being opened from within elFinder.

  I have requested a CVE-ID for this issue.

• You flagged this item as spam.
  

  Sachin Wagh December 26th, 2015 @ 05:54 PM

  Thanks dleffler.

  Once got the CVE-ID please update me accordingly.

  Thanks.

• 

  expNinja December 26th, 2015 @ 05:56 PM

  • State changed from “new” to “resolved”

  (from [148790795acba350fc42bd236b7f0da4a6e0e10e]) Fix security issue by strengthening the server security parameters in folders receiving uploads and tighten elFinder security by not allow any files to be opened (only folders)...you'll need to use the 'preview' or 'edit' commands or click on the link in the 'info' dialog which will enforce the server security settings.[#1323 state:resolved] https://github.com/exponentcms/exponent-cms/commit/148790795acba350...

• 

  dleffler December 26th, 2015 @ 11:56 PM

  CVE-2015-8684