CVE-2019-1010308: Insufficiently Protected Credentials (CWE-522)
value: Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It contains sensitive information like passwords etc. The component is: log file. The attack vector is: open the file.
CWE description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS v3 base score: 9.8
Published: 2019-07-15T18:15Z
Repository: https://github.com/aquaverde/aquarius-core
Language: PHP
Files changed: backend/backend.php, config.base.php, config.override.php, lib/db/Users.php
Commit date: 2015-09-17 14:51:08 +0200
Commit message: allow login without password in DEV mode

Diff: diff --git a/backend/backend.php b/backend/backend.php
index 5cb61f5..0d7dc59 100644
--- a/backend/backend.php
+++ b/backend/backend.php
@@ -9,13 +9,14 @@ Log::backtrace('backend');
 /* Use sessions in backend */
     $aquarius->session_start();
 
 
 /* Process logins & load logged in user */
+    $allpass = $aquarius->conf('admin/allpass');
     require_once "db/Users.php";
-    $login_status = db_Users::authenticate();
-                
+    $login_status = db_Users::authenticate($allpass);
+
     // Redirect to frontend if user wants to
     if ($login_status instanceof db_User && isset($_REQUEST['login_frontend'])) {
         header('Location:'.PROJECT_URL);
         exit;
     }
diff --git a/config.base.php b/config.base.php
index aa05297..e4115ea 100644
--- a/config.base.php
+++ b/config.base.php
@@ -198,10 +198,20 @@ $config['admin']['allow_languageadmin'] = false;
   * Set this to '_blank' if you prefer the links to open a new window.
   * Changing this value will only affect newly added links. */
 $config['admin']['link_target'] = '';
 
 
+/** Omit password checking for backend logins.
+  * This is useful during development, use with care! Do not ever enable this
+  * on a publicly accessible system. Best enable DEV mode to get this, change it
+  * in config.local.php if at all.
+  *
+  * Preset is false.
+  */
+$config['admin']['allpass'] = false;
+
+
 /** Standard email address to use as sender address
   * This is used in the "Sender:" header when the system generates mails. The
   * "From:" header will also be set to this address should it not be set
   * explicitly.
   * 
diff --git a/config.override.php b/config.override.php
index 069ab01..3223e29 100644
--- a/config.override.php
+++ b/config.override.php
@@ -5,11 +5,12 @@
   *
   * If one of the override settings is unsuitable, you can override it again
   * in config.local.php.
   */
 if (DEV) {
-    /** Overrides suitable for developement */
+    /** Overrides suitable for development */
+    $config['admin']['allpass'] = true;
     $config['frontend']['domain'] = null;
     $config['frontend']['domains'] = array();
     $config['frontend']['cache']['templates'] = false;
     $config['initcache'] = false;
     $config['log']['php'] = true;
diff --git a/lib/db/Users.php b/lib/db/Users.php
index cbd05a3..badb9e8 100644
--- a/lib/db/Users.php
+++ b/lib/db/Users.php
@@ -38,18 +38,25 @@ class db_Users extends DB_DataObject
     );
 
     /** Verify user credentials and register user in session if successful.
       * Requires fields 'backend_login', 'username' and 'password' to be set in $_REQUEST
       *   backend_login: must be set or this method won't try to authenticate
+      *  @param $allpass optional parameter to skip password check
       *  @return user instance if login is successful, -1 if login failed, false if no login credentials were found.
       */
-    static function authenticate() {
+    static function authenticate($allpass=false) {
         if (isset($_REQUEST['backend_login'])) {
             $user = DB_DataObject::factory('users');
             $user->active = true;
             $user->name = $_REQUEST['username'];
-            $user->find(true);
+            $found = $user->find(true);
+
+            if ($found && $allpass) {
+                Log::debug("Logging in user '$user->name' without checking password");
+                $user->login();
+                return true;
+            }
 
             // Don't look whether that user exists, so we give less timing information
             // Instead, rely only on having a matching password
             $proffered_password = $_REQUEST['password'];
             if (in_array(

Vulnerable code:     $login_status = db_Users::authenticate();
                
    /** Overrides suitable for developement */
    static function authenticate() {
            $user->find(true);
Fixed code:     $allpass = $aquarius->conf('admin/allpass');
    $login_status = db_Users::authenticate($allpass);

/** Omit password checking for backend logins.
  * This is useful during development, use with care! Do not ever enable this
  * on a publicly accessible system. Best enable DEV mode to get this, change it
  * in config.local.php if at all.
  *
  * Preset is false.
  */
$config['admin']['allpass'] = false;


    /** Overrides suitable for development */
    $config['admin']['allpass'] = true;
      *  @param $allpass optional parameter to skip password check
    static function authenticate($allpass=false) {
            $found = $user->find(true);

            if ($found && $allpass) {
                Log::debug("Logging in user '$user->name' without checking password");
                $user->login();
                return true;
            }