CVE-2022-3422: Improper Privilege Management (CWE-269)
value: Account Takeover :: when see the info i can see the hash pass i can creaked it ............... Account Takeover :: when see the info i can see the forgot_password_token the hacker can send the request and changed the pass
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 7.5
Published: 2022-10-07T11:15Z
Repository: https://github.com/tooljet/tooljet
Language: TypeScript
Files changed: server/src/services/group_permissions.service.ts, server/test/controllers/group_permissions.e2e-spec.ts
Commit date: 2022-09-29 15:43:14 +0530
Commit message: Hide user data in group permissions get user API (#4141)

* Hide user data from group permission user API

* test case fix

* fix
Diff: diff --git a/server/src/services/group_permissions.service.ts b/server/src/services/group_permissions.service.ts
index f33fd95ba..99a3751d0 100644
--- a/server/src/services/group_permissions.service.ts
+++ b/server/src/services/group_permissions.service.ts
@@ -301,12 +301,13 @@ export class GroupPermissionsService {
     });
   }
 
   async findUsers(user: User, groupPermissionId: string): Promise<User[]> {
     return createQueryBuilder(User, 'users')
-      .innerJoinAndSelect('users.groupPermissions', 'group_permissions')
-      .innerJoinAndSelect('users.userGroupPermissions', 'user_group_permissions')
+      .select(['users.id', 'users.firstName', 'users.lastName', 'users.email'])
+      .innerJoin('users.groupPermissions', 'group_permissions')
+      .innerJoin('users.userGroupPermissions', 'user_group_permissions')
       .where('group_permissions.id = :groupPermissionId', {
         groupPermissionId,
       })
       .andWhere('group_permissions.organization_id = :organizationId', {
         organizationId: user.organizationId,
diff --git a/server/test/controllers/group_permissions.e2e-spec.ts b/server/test/controllers/group_permissions.e2e-spec.ts
index 2b5548399..7627c03bb 100644
--- a/server/test/controllers/group_permissions.e2e-spec.ts
+++ b/server/test/controllers/group_permissions.e2e-spec.ts
@@ -626,12 +626,14 @@ describe('group permissions controller', () => {
       const users = response.body.users;
 
       const user = users[0];
 
       expect(users).toHaveLength(1);
-      expect(user.default_organization_id).toBe(organization.id);
+      expect(Object.keys(user).sort()).toEqual(['id', 'email', 'first_name', 'last_name'].sort());
       expect(user.email).toBe('admin@tooljet.io');
+      expect(user.first_name).toBe('test');
+      expect(user.last_name).toBe('test');
     });
   });
 
   describe('GET /group_permissions/:id/addable_users', () => {
     it('should not allow unauthenticated admin', async () => {

Vulnerable code:       .innerJoinAndSelect('users.groupPermissions', 'group_permissions')
      .innerJoinAndSelect('users.userGroupPermissions', 'user_group_permissions')
      expect(user.default_organization_id).toBe(organization.id);
Fixed code:       .select(['users.id', 'users.firstName', 'users.lastName', 'users.email'])
      .innerJoin('users.groupPermissions', 'group_permissions')
      .innerJoin('users.userGroupPermissions', 'user_group_permissions')
      expect(Object.keys(user).sort()).toEqual(['id', 'email', 'first_name', 'last_name'].sort());
      expect(user.first_name).toBe('test');
      expect(user.last_name).toBe('test');