Tiny MCE/ Justboil.me vulnerability

LuqmanH · May 14, 2020, 1:16am

Hi

Our IT support for our OJS journals at tuwhera.aut.ac.nz reported a hack allowing images to be uploaded to all of our OJS instances (all OJS 3x) via the justboil.me plugin (TinyMCE) exploit:
TinyMCE JBimages 3.x JustBoilMe Arbitrary File Upload ≈ Packet Storm

Our sites have been taken off external networks while a solution is sought.
Can you please advise whether there is a patch or solution to this vulnerability?

Many thanks

asmecher · May 14, 2020, 1:43am

Hi @LuqmanH,

I’ve filed this at Remove JBImages plugin · Issue #5871 · pkp/pkp-lib · GitHub and will post information about patches shortly. In the meantime the quickest solution that won’t take down your site is to remove plugins/generic/tinymce/plugins/justboil.me and all of its contents.

Note that this does not affect OJS and OMP 3.2.0 and newer, or any release of OPS; the justboil.me TinyMCE plugin is not included in these releases.

Regards,
Alec Smecher
Public Knowledge Project Team

LuqmanH · May 14, 2020, 1:54am

Thanks @asmecher That’s great.
Yes, we are going to disable the plugin for now. We had to put all our upgrades on hold while in COVID19 lockdown so we’ve not made it to 3.2. Is there a replacement image upload plugin in that release?

asmecher · May 14, 2020, 1:58am

Hi @LuqmanH,

Yes, there’s a replacement for for justboil.me in 3.2.0 and newer – see https://github.com/pkp/pkp-lib/issues/4890.

Regards,
Alec Smecher
Public Knowledge Project Team

doridek · May 31, 2020, 11:27pm

Hi @asmecher,

I’ve managed the security issue from this instruction: Remove JBImages plugin · Issue #5871 · pkp/pkp-lib · GitHub in my 3.1.2-1 OJS installations. Now I can’t upload an image. We don’t have financial support to upgrade to 3.2x for now and I wanted to ask is there any possibility to upload images in another way?

Best regards
Dorota

abadan · June 1, 2020, 1:05pm

Perhaps a solution, while not updating the version of OJS, is to publish images in the Publisher Library:
https://docs.pkp.sfu.ca/learning-ojs/en/settings-workflow#publisher-library

asmecher · June 1, 2020, 6:01pm

Hi @doridek,

The changes that are already included in OJS 3.2.x can be applied to version 3.1.2 using the patches linked here: Remove JBImages plugin · Issue #5871 · pkp/pkp-lib · GitHub

Regards,
Alec Smecher
Public Knowledge Project Team

doridek · June 4, 2020, 9:12pm

Thank you @asmecher,

I’ve read the information about patches (pkp/pkp-lib#5871 Restore image upload to tinymce after removing vulne… by NateWr · Pull Request #5888 · pkp/pkp-lib · GitHub) but honestly I don’t know what to do with them. Correct me if I am wrong:

I have an OJS 3.1.2-1 version.

I created a file: PKPUploadPublicFileHandler.inc.php an put it in the [api/v1/_uploadPublicFile/] directory.
I should make changes in two files: classes/template/PKPTemplateManager.inc.php and js/controllers/SiteHandler.js

But I don’t have such files in my OJS installation directories.

Sorry for such question but my adventure with OJS and GitHub is still quite fresh…

Best regards
Dorota

asmecher · June 4, 2020, 11:29pm

Hi @doridek,

The files in step 2 of your post above can be found in the lib/pkp subdirectory.

Regards,
Alec Smecher
Public Knowledge Project Team

doridek · June 5, 2020, 9:19am

@asmecher - thank you very much! That worked and now I have the “image upload” button.

But still I have another problem:

I have applied the changes described in #5888 and pkp/ojs#2755 for 3 of our journals. In one case after choosing “upload” I can choose the file and it looks like it is uploading but after a while nothing hapens. I other 2 journals the image is constantly uploading:
image_upload

Where should I look for a solution? My OJS is 3.1.2-1

Best regards
Dorota

asmecher · June 5, 2020, 4:36pm

Hi @doridek,

I would suggest checking your PHP error log, your browser’s error console, and the file permissions in the public directory (specifically where OJS will be trying to upload the image – see successfully-uploaded images for the pattern).

Regards,
Alec Smecher
Public Knowledge Project Team

newone · June 21, 2020, 5:12am

@asmecher

Is there direction for making this change on OJS 2.4. 8?

I have patched OJS file manually in the past with no issue, but now, I cannot tell what files needs to be patched for this justboil me.

I looked at the gitbub link referenced above and downloaded the patch file for the version of OJS I am using. When I opened it, it is just black text and does not show any highlight for the lines that need to be removed.

Usually, in the past, I can see the affected lines highlighted on github.com as well as see it in the editor I use. Take a look at this page, it shows what needs to be removed and added. Is there something like that for jbimages? https://github.com/pkp/pkp-lib/commit/fd985570357049a986aeb8d33652092fbe5b88e2

I have removed the plugin jbimages.

How do I remove all instances of jbimages in OJS 2.4.8?

Or anyone else that can help, would be greatly appreciated.

Newone

asmecher · July 11, 2020, 1:12am

Hi @newone,

Patch files are designed to be applied by the GNU patch tool, rather than read and applied manually. However, most programmer’s text editors know how to do syntax highlighting on patch files, so you might try opening that file in another editor. (I use vim, which does highlight patch files.)

Regards,
Alec Smecher
Public Knowledge Project Team

newone · July 11, 2020, 5:28pm

Hi @asmecher

I am not a programmer, I don’t have access to any of the tools mentioned, and vi is for unix systems. I patch manually by editing the lines in the file. I have windows and use Notepad++.

Is this the link for OJS 2.4.8? https://github.com/pkp/pkp-lib/files/4626180/ojs-2.4.8-5.diff.txt

When I opened the file, it does not show any highlighted changes. Many lines show -|. On github, you can see what line should be removed and added, like 223 and 224: https://github.com/pkp/pkp-lib/commit/fd985570357049a986aeb8d33652092fbe5b88e2

My question is that the current patch does not indicate what needs to be removed.

Will deleting the plugin fix this issue?

Thanks

asmecher · July 11, 2020, 11:49pm

Hi @newone,

You might be able to get Notepad++ to appropriately highlight the file by giving it a .diff or .patch suffix, rather than .txt.

Regards,
Alec Smecher
Public Knowledge Project Team

newone · July 13, 2020, 5:09am

Hi @asmecher ,

Will deleting the plugin fix this issue?

asmecher · July 13, 2020, 3:09pm

Hi @newone,

That’s what the patch file does, when you apply it. If you make the same changes that are described in the patch file, it will remove the plugin and anything that refers to it.

Regards,
Alec Smecher
Public Knowledge Project Team

newone · July 13, 2020, 6:55pm

Thanks @asmecher

I had already deleted the plugin folder much earlier.

Is there a way to remove all the other references of the plugin?

asmecher · July 13, 2020, 10:09pm

Hi @newone,

Yes, either apply the patch (manually as you’ve done before or using the GNU patch tool), or follow the instructions under “Manual Correction” at Remove JBImages plugin · Issue #5871 · pkp/pkp-lib · GitHub.

Regards,
Alec Smecher
Public Knowledge Project Team

newone · July 30, 2020, 7:25am

Hi @asmecher,

That was my original question. The patch is not clear as the previous OJS patches were, which can be viewed on github website. For example, the patch is a diff file and it is not clear what needs to be removed and what needs to stay, and it is too long. Can a patch that follows in line with previous patches be made?

Manual is still command. I had already explained previously that I don’t have access to shell/command.

-Newone