{"action":"created","issue":{"url":"https://api.github.com/repos/Froxlor/Froxlor/issues/555","repository_url":"https://api.github.com/repos/Froxlor/Froxlor","labels_url":"https://api.github.com/repos/Froxlor/Froxlor/issues/555/labels{/name}","comments_url":"https://api.github.com/repos/Froxlor/Froxlor/issues/555/comments","events_url":"https://api.github.com/repos/Froxlor/Froxlor/issues/555/events","html_url":"https://github.com/Froxlor/Froxlor/issues/555","id":327308450,"node_id":"MDU6SXNzdWUzMjczMDg0NTA=","number":555,"title":"PHP Object Serialisation Bug","user":{"login":"ProDigySML","id":16996819,"node_id":"MDQ6VXNlcjE2OTk2ODE5","avatar_url":"https://avatars1.githubusercontent.com/u/16996819?v=4","gravatar_id":"","url":"https://api.github.com/users/ProDigySML","html_url":"https://github.com/ProDigySML","followers_url":"https://api.github.com/users/ProDigySML/followers","following_url":"https://api.github.com/users/ProDigySML/following{/other_user}","gists_url":"https://api.github.com/users/ProDigySML/gists{/gist_id}","starred_url":"https://api.github.com/users/ProDigySML/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ProDigySML/subscriptions","organizations_url":"https://api.github.com/users/ProDigySML/orgs","repos_url":"https://api.github.com/users/ProDigySML/repos","events_url":"https://api.github.com/users/ProDigySML/events{/privacy}","received_events_url":"https://api.github.com/users/ProDigySML/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"d00p","id":1757229,"node_id":"MDQ6VXNlcjE3NTcyMjk=","avatar_url":"https://avatars3.githubusercontent.com/u/1757229?v=4","gravatar_id":"","url":"https://api.github.com/users/d00p","html_url":"https://github.com/d00p","followers_url":"https://api.github.com/users/d00p/followers","following_url":"https://api.github.com/users/d00p/following{/other_user}","gists_url":"https://api.github.com/users/d00p/gists{/gist_id}","starred_url":"https://api.github.com/users/d00p/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/d00p/subscriptions","organizations_url":"https://api.github.com/users/d00p/orgs","repos_url":"https://api.github.com/users/d00p/repos","events_url":"https://api.github.com/users/d00p/events{/privacy}","received_events_url":"https://api.github.com/users/d00p/received_events","type":"User","site_admin":false},"assignees":[{"login":"d00p","id":1757229,"node_id":"MDQ6VXNlcjE3NTcyMjk=","avatar_url":"https://avatars3.githubusercontent.com/u/1757229?v=4","gravatar_id":"","url":"https://api.github.com/users/d00p","html_url":"https://github.com/d00p","followers_url":"https://api.github.com/users/d00p/followers","following_url":"https://api.github.com/users/d00p/following{/other_user}","gists_url":"https://api.github.com/users/d00p/gists{/gist_id}","starred_url":"https://api.github.com/users/d00p/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/d00p/subscriptions","organizations_url":"https://api.github.com/users/d00p/orgs","repos_url":"https://api.github.com/users/d00p/repos","events_url":"https://api.github.com/users/d00p/events{/privacy}","received_events_url":"https://api.github.com/users/d00p/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-05-29T12:56:06Z","updated_at":"2018-06-27T06:57:07Z","closed_at":"2018-05-29T13:47:50Z","author_association":"NONE","body":"# Summary\r\nAn attacker with administrative privileges can perform PHP object serialisation attacks, which can possibly lead to remote code execution. \r\n\r\n\r\n\r\n# System information\r\n* Froxlor version: 0.9.39.5\r\n* Web server: apache2\r\n* DNS server: Bind\r\n* POP/IMAP server: Courier\r\n* SMTP server: postfix\r\n* FTP server: proftpd\r\n* OS/Version:  Ubuntu\r\n\r\n# Vulnerable Section\r\nhttps://github.com/Froxlor/Froxlor/blob/27f8c8b4384a1a5fb0a9bd8cda3d24ff562ee0e5/admin_domains.php#L566-L568\r\n\r\nAn administrator user can create a new domain and use the code above to deserialise a PHP object, running it's magic methods to execute PHP commands on the server. This may lead to remote code execution"},"comment":{"url":"https://api.github.com/repos/Froxlor/Froxlor/issues/comments/400563702","html_url":"https://github.com/Froxlor/Froxlor/issues/555#issuecomment-400563702","issue_url":"https://api.github.com/repos/Froxlor/Froxlor/issues/555","id":400563702,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMDU2MzcwMg==","user":{"login":"abergmann","id":4102163,"node_id":"MDQ6VXNlcjQxMDIxNjM=","avatar_url":"https://avatars3.githubusercontent.com/u/4102163?v=4","gravatar_id":"","url":"https://api.github.com/users/abergmann","html_url":"https://github.com/abergmann","followers_url":"https://api.github.com/users/abergmann/followers","following_url":"https://api.github.com/users/abergmann/following{/other_user}","gists_url":"https://api.github.com/users/abergmann/gists{/gist_id}","starred_url":"https://api.github.com/users/abergmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abergmann/subscriptions","organizations_url":"https://api.github.com/users/abergmann/orgs","repos_url":"https://api.github.com/users/abergmann/repos","events_url":"https://api.github.com/users/abergmann/events{/privacy}","received_events_url":"https://api.github.com/users/abergmann/received_events","type":"User","site_admin":false},"created_at":"2018-06-27T06:57:06Z","updated_at":"2018-06-27T06:57:06Z","author_association":"NONE","body":"[CVE-2018-1000527](https://nvd.nist.gov/vuln/detail/CVE-2018-1000527) was assigned to this issue."}}
{"actor":{"display_login":"abergmann"}}