CVE-2023-48218: Incorrect Authorization (CWE-863)
value: The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 5.3
Published: 2023-11-20T17:15Z
Repository: https://github.com/strapi-community/strapi-plugin-protected-populate
Language: JavaScript
Files changed: server/middlewares/helpers/protect-route.js
Commit date: 2023-11-13 20:53:11 +0100
Commit message: fix fields always populating ID

Diff: diff --git a/server/middlewares/helpers/protect-route.js b/server/middlewares/helpers/protect-route.js
index 8936efd..a453adb 100644
--- a/server/middlewares/helpers/protect-route.js
+++ b/server/middlewares/helpers/protect-route.js
@@ -21,25 +21,25 @@ const protectPopulate = (populate, info) => {
     populate = {};
   }
   //fields
   if (typeof info.on === 'undefined') {
     if (typeof info.fields === 'undefined') {
-      populate.fields = [];
+      populate.fields = ['id'];
     } else if (typeof populate.fields === 'undefined') {
       //Don't have to check main mainBoolean since if it is true fields is also "undefined"
-      populate.fields = info.fields;
+      populate.fields = ['id', ...info.fields];
     } else if (Array.isArray(populate.fields)) {
-      let fields = [];
+      let fields = ['id'];
       populate.fields.forEach((value) => {
         if (info.fields.includes(value)) {
           fields.push(value);
         }
       });
       populate.fields = fields;
     } else {
       //Unexpected input handle it if it was empty
-      populate.fields = info.fields;
+      populate.fields = ['id', ...info.fields];
     }
   }
   //Deal with array input for populate
   if (Array.isArray(populate.populate)) {
     const data = {};
@@ -103,10 +103,11 @@ const protectPopulate = (populate, info) => {
       delete populate['fields'];
       delete populate['populate'];
       populate = AllowedList;
     }
   } else {
+    //DZ
     //populate
     if (typeof info.populate === 'undefined') {
       populate.populate = {};
     } else if (populate.populate === '*' || mainBoolean === true) {
       let populateAllowed = {};
@@ -162,11 +163,11 @@ const protectFilters = (filters, info) => {
   return filtersAllowed;
 };
 
 const protectRoute = (query, info) => {
   const savePopulate = protectPopulate(query, info);
-  query.populate = savePopulate.populate;
+  query.populate = savePopulate.populate || savePopulate.on;
   query.fields = savePopulate.fields;
   query.filters = protectFilters(query.filters, info);
   return query;
 };
 

Vulnerable code:       populate.fields = [];
      populate.fields = info.fields;
      let fields = [];
      populate.fields = info.fields;
  query.populate = savePopulate.populate;
Fixed code:       populate.fields = ['id'];
      populate.fields = ['id', ...info.fields];
      let fields = ['id'];
      populate.fields = ['id', ...info.fields];
    //DZ
  query.populate = savePopulate.populate || savePopulate.on;