CVE-2024-21665: Other (NVD-CWE-Other)
value: ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 4.3
Published: 2024-01-11T01:15Z
Repository: https://github.com/pimcore/ecommerce-framework-bundle
Language: PHP
Files changed: src/Controller/AdminOrderController.php, src/Controller/ConfigController.php, src/Controller/FindologicController.php, src/Controller/IndexController.php, src/Controller/PricingController.php, src/Controller/VoucherController.php
Commit date: 2024-01-08 14:42:56 +0100
Commit message: [Task]: Improve permission check (#149)

* add permission check

* add permission check

* add permission check

* replace with UserAwareController

* remov eextra break line
Diff: diff --git a/src/Controller/AdminOrderController.php b/src/Controller/AdminOrderController.php
index 89f8c57b..7da7a648 100644
--- a/src/Controller/AdminOrderController.php
+++ b/src/Controller/AdminOrderController.php
@@ -66,10 +66,12 @@ class AdminOrderController extends UserAwareController implements KernelControll
     {
     }
 
     public function onKernelControllerEvent(ControllerEvent $event): void
     {
+        $this->checkPermission('bundle_ecommerce_back-office_order');
+
         // set language
         $user = $this->tokenResolver->getUser();
 
         if ($user) {
             if ($this->translator instanceof LocaleAwareInterface) {
diff --git a/src/Controller/ConfigController.php b/src/Controller/ConfigController.php
index 9e76378c..9c22a7f6 100644
--- a/src/Controller/ConfigController.php
+++ b/src/Controller/ConfigController.php
@@ -14,23 +14,25 @@ declare(strict_types=1);
  *  @license    http://www.pimcore.org/license     GPLv3 and PCL
  */
 
 namespace Pimcore\Bundle\EcommerceFrameworkBundle\Controller;
 
+use Pimcore\Controller\KernelControllerEventInterface;
 use Pimcore\Controller\UserAwareController;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\Routing\Annotation\Route;
 use Symfony\Component\Routing\RouterInterface;
 
 /**
  * Class ConfigController
  *
  * @Route("/config")
  *
  * @internal
  */
-class ConfigController extends UserAwareController
+class ConfigController extends UserAwareController implements KernelControllerEventInterface
 {
     /**
      * ConfigController constructor.
      *
      * @param RouterInterface $router
@@ -38,10 +40,15 @@ class ConfigController extends UserAwareController
     public function __construct(private RouterInterface $router)
     {
         $this->router = $router;
     }
 
+    public function onKernelControllerEvent(ControllerEvent $event): void
+    {
+        $this->checkPermission('bundle_ecommerce_back-office_order');
+    }
+
     /**
      * @Route("/js-config", name="pimcore_ecommerceframework_config_jsconfig", methods={"GET"})
      *
      * @return Response
      */
diff --git a/src/Controller/FindologicController.php b/src/Controller/FindologicController.php
index 372770af..30ddf52f 100644
--- a/src/Controller/FindologicController.php
+++ b/src/Controller/FindologicController.php
@@ -14,23 +14,30 @@ declare(strict_types=1);
  *  @license    http://www.pimcore.org/license     GPLv3 and PCL
  */
 
 namespace Pimcore\Bundle\EcommerceFrameworkBundle\Controller;
 
-use Pimcore\Controller\FrontendController;
+use Pimcore\Controller\KernelControllerEventInterface;
+use Pimcore\Controller\UserAwareController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
 
 /**
  * Class FindologicController
  *
  * Routing see routing.yaml
  *
  * @internal
  */
-class FindologicController extends FrontendController
+class FindologicController extends UserAwareController implements KernelControllerEventInterface
 {
+    public function onKernelControllerEvent(ControllerEvent $event): void
+    {
+        $this->checkPermission('bundle_ecommerce_back-office_order');
+    }
+
     /**
      * create xml output for findologic
      */
     public function exportAction(Request $request): Response
     {
diff --git a/src/Controller/IndexController.php b/src/Controller/IndexController.php
index 4a815e6c..8df65ee0 100644
--- a/src/Controller/IndexController.php
+++ b/src/Controller/IndexController.php
@@ -17,15 +17,17 @@ declare(strict_types=1);
 namespace Pimcore\Bundle\EcommerceFrameworkBundle\Controller;
 
 use Pimcore\Bundle\EcommerceFrameworkBundle\Event\AdminEvents;
 use Pimcore\Bundle\EcommerceFrameworkBundle\Factory;
 use Pimcore\Bundle\EcommerceFrameworkBundle\IndexService\ProductList\ProductListInterface;
+use Pimcore\Controller\KernelControllerEventInterface;
 use Pimcore\Controller\Traits\JsonHelperTrait;
 use Pimcore\Controller\UserAwareController;
 use Symfony\Component\EventDispatcher\GenericEvent;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\Routing\Annotation\Route;
 use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
 use Symfony\Contracts\Translation\TranslatorInterface;
 
 /**
@@ -33,14 +35,19 @@ use Symfony\Contracts\Translation\TranslatorInterface;
  *
  * @Route("/index")
  *
  * @internal
  */
-class IndexController extends UserAwareController
+class IndexController extends UserAwareController implements KernelControllerEventInterface
 {
     use JsonHelperTrait;
 
+    public function onKernelControllerEvent(ControllerEvent $event): void
+    {
+        $this->checkPermission('bundle_ecommerce_back-office_order');
+    }
+
     /**
      * @Route("/get-filter-groups", name="pimcore_ecommerceframework_index_getfiltergroups", methods={"GET"})
      *
      * @return JsonResponse
      */
diff --git a/src/Controller/PricingController.php b/src/Controller/PricingController.php
index a4a4714e..36d67add 100644
--- a/src/Controller/PricingController.php
+++ b/src/Controller/PricingController.php
@@ -41,14 +41,11 @@ class PricingController extends UserAwareController implements KernelControllerE
     use JsonHelperTrait;
 
     public function onKernelControllerEvent(ControllerEvent $event): void
     {
         // permission check
-        $access = $this->getPimcoreUser()->isAllowed('bundle_ecommerce_pricing_rules');
-        if (!$access) {
-            throw new \Exception('this function requires "bundle_ecommerce_pricing_rules" permission!');
-        }
+        $this->checkPermission('bundle_ecommerce_pricing_rules');
     }
 
     /**
      * @Route("/list", name="pimcore_ecommerceframework_pricing_list", methods={"GET"})
      */
diff --git a/src/Controller/VoucherController.php b/src/Controller/VoucherController.php
index 7a1e7e34..09491f6d 100644
--- a/src/Controller/VoucherController.php
+++ b/src/Controller/VoucherController.php
@@ -15,12 +15,12 @@ declare(strict_types=1);
  */
 
 namespace Pimcore\Bundle\EcommerceFrameworkBundle\Controller;
 
 use Pimcore\Bundle\EcommerceFrameworkBundle\VoucherService\TokenManager\ExportableTokenManagerInterface;
-use Pimcore\Controller\FrontendController;
 use Pimcore\Controller\KernelControllerEventInterface;
+use Pimcore\Controller\UserAwareController;
 use Pimcore\Model\DataObject;
 use Pimcore\Model\DataObject\Localizedfield;
 use Pimcore\Model\DataObject\OnlineShopVoucherSeries;
 use Pimcore\Security\User\TokenStorageUserResolver;
 use Symfony\Component\HttpFoundation\Request;
@@ -35,11 +35,11 @@ use Symfony\Contracts\Translation\TranslatorInterface;
  *
  * @Route("/voucher")
  *
  * @internal
  */
-class VoucherController extends FrontendController implements KernelControllerEventInterface
+class VoucherController extends UserAwareController implements KernelControllerEventInterface
 {
     protected TokenStorageUserResolver $tokenResolver;
 
     protected TranslatorInterface $translator;
 
@@ -53,10 +53,12 @@ class VoucherController extends FrontendController implements KernelControllerEv
         $this->translator = $translator;
     }
 
     public function onKernelControllerEvent(ControllerEvent $event): void
     {
+        $this->checkPermission('bundle_ecommerce_pricing_rules');
+
         // set language
         $user = $this->tokenResolver->getUser();
 
         if ($user) {
             if ($this->translator instanceof LocaleAwareInterface) {

Vulnerable code: class ConfigController extends UserAwareController
use Pimcore\Controller\FrontendController;
class FindologicController extends FrontendController
class IndexController extends UserAwareController
        $access = $this->getPimcoreUser()->isAllowed('bundle_ecommerce_pricing_rules');
        if (!$access) {
            throw new \Exception('this function requires "bundle_ecommerce_pricing_rules" permission!');
        }
use Pimcore\Controller\FrontendController;
class VoucherController extends FrontendController implements KernelControllerEventInterface
Fixed code:         $this->checkPermission('bundle_ecommerce_back-office_order');

use Pimcore\Controller\KernelControllerEventInterface;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class ConfigController extends UserAwareController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        $this->checkPermission('bundle_ecommerce_back-office_order');
    }

use Pimcore\Controller\KernelControllerEventInterface;
use Pimcore\Controller\UserAwareController;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class FindologicController extends UserAwareController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        $this->checkPermission('bundle_ecommerce_back-office_order');
    }

use Pimcore\Controller\KernelControllerEventInterface;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class IndexController extends UserAwareController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event): void
    {
        $this->checkPermission('bundle_ecommerce_back-office_order');
    }

        $this->checkPermission('bundle_ecommerce_pricing_rules');
use Pimcore\Controller\UserAwareController;
class VoucherController extends UserAwareController implements KernelControllerEventInterface
        $this->checkPermission('bundle_ecommerce_pricing_rules');