[MDL-68443] Improve XMLDB path validation of included files - Moodle Tracker

XML

Word

Printable

Affected Branches:
MOODLE_35_STABLE, MOODLE_36_STABLE, MOODLE_37_STABLE, MOODLE_38_STABLE, MOODLE_39_STABLE
Fixed Branches:
MOODLE_37_STABLE, MOODLE_38_STABLE
Pull from Repository:
https://github.com/brendanheywood/moodle
Pull Master Branch:
~~MDL-68443~~-xmldb-path-validation
Pull Master Diff URL:
https://github.com/moodle/moodle/compare/master...brendanheywood:MDL-68443-xmldb-path-validation
Testing Instructions:

Hide

1) Log in as admin

2) Go here are confirm that it still loads the xml file:

http://moodle.local/admin/tool/xmldb/index.php?action=view_xml&file=%2Fadmin%2Ftool%2Fcohortroles%2Fdb%2Finstall.xml

3) Confirm that all of the following urls result in an exception:

http://moodle.local/admin/tool/xmldb/index.php?action=view_xml&file=/lib/db/caches.php

http://moodle.local/admin/tool/xmldb/index.php?action=view_xml&file=/lib/xmldb/xmldb_file.php

Show
1) Log in as admin 2) Go here are confirm that it still loads the xml file: http://moodle.local/admin/tool/xmldb/index.php?action=view_xml&file=%2Fadmin%2Ftool%2Fcohortroles%2Fdb%2Finstall.xml 3) Confirm that all of the following urls result in an exception: http://moodle.local/admin/tool/xmldb/index.php?action=view_xml&file=/lib/db/caches.php http://moodle.local/admin/tool/xmldb/index.php?action=view_xml&file=/lib/xmldb/xmldb_file.php

We've had a pen test report back: Local File Inclusion (LFI) vulnerability was detected

The risk here is very low generally but in some edge cases is worse.

It allows an admin to view a class of files raw source which includes php files.

eg:

In an extreme version IF by pure misfortune your www dir is something ending in the letters 'db' such as /var/www/learningdb/ then you can actually do this and grab all the db connection strings etc:

http://moodle.local/admin/tool/xmldb/index.php?action=view_xml&file=..//..//..//config.php

Participants:: Brendan Heywood, CiBoT, Eloy Lafuente (stronk7), Janelle Barcega, Peter Burnett

Component watchers:: David Woloszyn, Huong Nguyen, Jake Dallimore, Meirza, Michael Hawkins, Raquel Ortega, Safat Shahin, Stevani Andolo

Estimated:

Not Specified

Remaining:

Logged:

44m