CVE-2022-25319: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2022-02-18T06:15Z
Repository: https://github.com/cerebrate-project/cerebrate
Language: PHP
Files changed: src/Controller/Open/IndividualsController.php, src/Controller/Open/OrganisationsController.php
Commit date: 2022-02-04 00:36:31 +0100
Commit message: fix: [security] open endpoints should only be open when enabled

- as reported by Dawid Czarnecki from Zigrin Security

Diff: diff --git a/src/Controller/Open/IndividualsController.php b/src/Controller/Open/IndividualsController.php
index 28cd51de..79af257d 100644
--- a/src/Controller/Open/IndividualsController.php
+++ b/src/Controller/Open/IndividualsController.php
@@ -9,17 +9,21 @@ use \Cake\Database\Expression\QueryExpression;
 use Cake\Http\Exception\BadRequestException;
 use Cake\Http\Exception\NotFoundException;
 use Cake\Http\Exception\MethodNotAllowedException;
 use Cake\Http\Exception\ForbiddenException;
 use Cake\Event\EventInterface;
+use Cake\Core\Configure;
 
 class IndividualsController extends AppController
 {
     public function beforeFilter(EventInterface $event)
     {
         parent::beforeFilter($event);
-        $this->Authentication->allowUnauthenticated(['index']);
+        $open = Configure::read('Cerebrate.open');
+        if (!empty($open) && in_array('individuals', $open)) {
+            $this->Authentication->allowUnauthenticated(['index']);
+        }
     }
 
     public function index()
     {
         $this->CRUD->index([
diff --git a/src/Controller/Open/OrganisationsController.php b/src/Controller/Open/OrganisationsController.php
index ad22f425..facda8a9 100644
--- a/src/Controller/Open/OrganisationsController.php
+++ b/src/Controller/Open/OrganisationsController.php
@@ -8,17 +8,21 @@ use Cake\Utility\Text;
 use \Cake\Database\Expression\QueryExpression;
 use Cake\Http\Exception\NotFoundException;
 use Cake\Http\Exception\MethodNotAllowedException;
 use Cake\Http\Exception\ForbiddenException;
 use Cake\Event\EventInterface;
+use Cake\Core\Configure;
 
 class OrganisationsController extends AppController
 {
     public function beforeFilter(EventInterface $event)
     {
         parent::beforeFilter($event);
-        $this->Authentication->allowUnauthenticated(['index']);
+        $open = Configure::read('Cerebrate.open');
+        if (!empty($open) && in_array('organisations', $open)) {
+            $this->Authentication->allowUnauthenticated(['index']);
+        }
     }
 
     public function index()
     {
         $this->CRUD->index([

Vulnerable code:         $this->Authentication->allowUnauthenticated(['index']);
        $this->Authentication->allowUnauthenticated(['index']);
Fixed code: use Cake\Core\Configure;
        $open = Configure::read('Cerebrate.open');
        if (!empty($open) && in_array('individuals', $open)) {
            $this->Authentication->allowUnauthenticated(['index']);
        }
use Cake\Core\Configure;
        $open = Configure::read('Cerebrate.open');
        if (!empty($open) && in_array('organisations', $open)) {
            $this->Authentication->allowUnauthenticated(['index']);
        }