[GHSA-g8pg-33v4-9r96] Thelia authentication bypass vulnerability

[RainSignal]

Updates

• Affected products
• Description

Comments
The advisory states the vulnerability is present from 2.1.0-beta1,
but code review shows this is incorrect. We examined the file
TokenProvider.php across multiple versions and confirmed the
vulnerable unserialize() code exists in all of them:

• 2.0.0-RC1: vulnerable (earliest version checked)
  https://github.com/thelia/thelia/blob/2.0.0-RC1/core/lib/Thelia/Core/Security/Token/TokenProvider.php
• 2.0.12: vulnerable
  https://github.com/thelia/thelia/blob/2.0.12/core/lib/Thelia/Core/Security/Token/TokenProvider.php
• 2.1.0-alpha2: vulnerable
  https://github.com/thelia/thelia/blob/2.1.0-alpha2/core/lib/Thelia/Core/Security/Token/TokenProvider.php
• 2.1.0-beta1: vulnerable
• 2.1.3: fixed

Since 2.0.0-RC1 is the earliest version we checked and already
contains the vulnerable code, the affected version range should
be updated to >= 2.0.0-RC1. The true introduction point may be
even earlier, but we could not confirm versions prior to 2.0.0-RC1.

Therefore, the affected versions should be changed from
">= 2.1.0-beta1, < 2.1.3" to "< 2.1.3".

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[shelbyc]

Hi @RainSignal, this PR is being merged agree with the decision to change the lower bound. I think it's possible that 2.1.0-beta1 was a typo.

Two lines of code from the fix commit thelia/thelia@028cfcf were introduced in two different commits.

As you pointed out, thelia/thelia@71c1cee introduced $data = unserialize(base64_decode($key)); in a commit tagged with 2.0.0-RC1 on GitHub. However, thelia/thelia@71c1cee was committed on 13 September 2013, and https://packagist.org/packages/thelia/thelia#2.0.0-beta1 shows that 2.0.0-beta1 was released on 25 October 2013. https://packagist.org/packages/thelia/thelia#2.0.0-RC1 shows that 2.0.0-RC1 was released on 03 March 2014.

thelia/thelia@a4ad03c introduced return base64_encode(serialize(array($user->getUsername(), $user->getToken(), $user->getSerial()))); in version 2.1.0-alpha1.

My hypothesis is that the author https://web.archive.org/web/20160502224630/http://thelia.net/version-2-1-3-with-security-fix intended to type 2.0.0-beta1 but confused 2.0.0-beta1 and 2.1.0-alpha1 and their fingers produced 2.1.0-beta1 as a mistake.

Thanks for the PR and gave a good weekend!

[advisory-database]

Hi @RainSignal! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!