Arbitrary image download

Nobody seemed interested so I made it public. Its not exactly a 0day anyway.

Hello Tom,

Thank you very much for your report.

I'm sorry that nobody had yet responded to your report. I was only recently added to the security group, but only after you had sent your report. We take security seriously at Mahara and do try to respond to any reports very quickly. Unfortunately, this had slipped our attention.

One of our developers will look into this and get back to you as soon as possible.

As it does concern permissions that could be exploited, I reverted the report back to "Private Security".

Thank you again for your report.

Cheers
Kristina

Hi all,

Yeah, sorry about not responding. It appears that our security team wasn't getting subscribed to new security bugs. So, I'm looking into that as well.

Cheers,
Aaron

Hi Robert,

While working on the Page Skins feature, I had an idea relating to this. One way we can help verify that all attached File artefacts are ones that the user is allowed to use, is that we could put it in the Pieform filebrowser element. Normally, the best function to put it in would probably be the pieform_element_{$type}_set_attributes() function, but in the case of filebrowser it hacks the normal control flow for Pieforms and does the upload in pieform_element_filebrowser_get_value(). So we'd have to place it in there somewhere if we were to do this.

If the other artefact selectors are using Pieform elements, we may be able to use something similar for them.

Cheers,
Aaron

Hi Aaron,

The problem is the site looks to save bad values without actually calling the pieform_element_filebrowser_get_value()

When I save valid data the function is called but if I do the hack and save bad data the function is not called.

the only consistent joy I can get (so far) is checking the function instance_config_store(Pieform $form, $values)
and am able to check there if the artefactids are valid

Robert posted a patch for this: https://reviews.mahara.org/#/c/2487/

Okay, the patch has been reviewed and approved. The final merge patches:

1.5: https://reviews.mahara.org/#/c/2568/
1.6: https://reviews.mahara.org/#/c/2569/
1.7: https://reviews.mahara.org/#/c/2570/
1.8: https://reviews.mahara.org/#/c/2567/

Hi Tom,

I just wanted to say thanks again for this report. Looking through the code to resolve this issue, it appears that the Mahara code base is pretty thorough about checking that the user always has the correct permissions for Pages that they want to manipulate, but it was not as thorough about Artefacts. (As you noted, all content in Mahara is stored as an abstract "artefact").

We've developed a patch which covers all the loopholes we could find, and we'll release that shortly in our next minor release. I'm sure there may be some spots that we've missed, so please do let us know if you find any others.

By the way, do you want to be listed on the Mahara security contributors page? https://wiki.mahara.org/index.php/Contributors#Security_researchers

Cheers,
Aaron

We had difficulty implementing a fix for issue #3 in this bug's description: the export of pages that already include links to other users' artefacts. So since preventing the linking to other users' artefacts mitigates the risk of that vulnerability somewhat, I've gone ahead and spun that out into a separate bug: https://bugs.launchpad.net/mahara/+bug/1234615

Heya Aaron,
I would quite like to be listed on the security contributors page, could you link to my blog at http://tomforb.es ?

Thanks!

Hi Tom,

Sure thing: https://wiki.mahara.org/index.php/Contributors#Security_researchers

Cheers,
Aaron