脆弱性

-------------------------------------------------------------------
■脆弱性の種類
-------------------------------------------------------------------
一部環境における、管理画面の不適切な認証に関する脆弱性


-------------------------------------------------------------------
■不具合が存在するEC-CUBEのバージョン
-------------------------------------------------------------------
EC-CUBE　2.11.0 以降 (2011年3月23日公開～)

-------------------------------------------------------------------
■修正方法について(以下は Ver2.12.3 の修正となっております。)
-------------------------------------------------------------------
/data/class/helper/SC_Helper_Session.php
に以下の変更を加えます。

※修正ファイルの詳細はこちらをご確認ください
http://www.ec-cube.net/info/weakness/20130522/index.php

▽SC_Helper_Session.php
217行目付近
-----------------------------------------------------------------------------------------------------------------
 変更前
-----------------------------------------------------------------------------------------------------------------
function adminAuthorization() {
    $masterData = new SC_DB_MasterData_Ex();
    $arrExcludes = $masterData->getMasterData('mtb_auth_excludes');
    if (preg_match('|^' . ROOT_URLPATH . ADMIN_DIR . '|', $_SERVER['SCRIPT_NAME'])) {
        $is_auth = true;

        foreach ($arrExcludes as $exclude) {
            if (preg_match('|^' . ROOT_URLPATH . ADMIN_DIR . $exclude . '|', $_SERVER['SCRIPT_NAME'])) {
                $is_auth = false;
                break;
            }
        }
        if ($is_auth) {
            SC_Utils_Ex::sfIsSuccess(new SC_Session_Ex());
        }
    }
}
-----------------------------------------------------------------------------------------------------------------

-----------------------------------------------------------------------------------------------------------------
 変更後
-----------------------------------------------------------------------------------------------------------------
function adminAuthorization() {
    if (($script_path = realpath($_SERVER['SCRIPT_FILENAME'])) !== FALSE) {
        $arrScriptPath = explode('/', str_replace('\\', '/', $script_path));
        $arrAdminPath = explode('/', str_replace('\\', '/', substr(HTML_REALDIR . ADMIN_DIR, 0, -1)));
        $arrDiff = array_diff_assoc($arrAdminPath, $arrScriptPath);
        if (in_array(substr(ADMIN_DIR, 0, -1), $arrDiff)) {
            return;
        } else {
            $masterData = new SC_DB_MasterData_Ex();
            $arrExcludes = $masterData->getMasterData('mtb_auth_excludes');
            foreach ($arrExcludes as $exclude) {
                $arrExcludesPath = explode('/', str_replace('\\', '/', HTML_REALDIR . ADMIN_DIR . $exclude));
                $arrDiff = array_diff_assoc($arrExcludesPath, $arrScriptPath);
                if (count($arrDiff) === 0) {
                    return;
                }
            }
        }
    }
    SC_Utils_Ex::sfIsSuccess(new SC_Session_Ex());
}
-----------------------------------------------------------------------------------------------------------------

下記のリビジョンで修正
http://svn.ec-cube.net/open_trac/changeset/22826