CVE-2022-42724: Incorrect Authorization (CWE-863)
value: app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.3
Published: 2022-10-10T05:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/UsersController.php
Commit date: 2022-10-06 09:48:08 +0200
Commit message: security: [user] Fixing disclosure of roles name to non-site admin users and ensure user edit applies the restricted_to_site_admin option


This vulnerability with a default MISP installation without additional roles is disclosing list of role name which were restricted to the site admin. This commit fixes this disclosure vulnerability.

In addition for MISP installation with custom roles, an org admin user could create a user assigned to new custom roles which were restricted to site admin. This could lead to the access of complementary permissions (except site admin, org admin and sync actions).

Credits: CIRCL

Diff: diff --git a/app/Controller/UsersController.php b/app/Controller/UsersController.php
index 8012fa4e1d22..bfc832f545e4 100644
--- a/app/Controller/UsersController.php
+++ b/app/Controller/UsersController.php
@@ -618,11 +618,11 @@ class UsersController extends AppController
 
     public function admin_add()
     {
         $params = null;
         if (!$this->_isSiteAdmin()) {
-            $params = array('conditions' => array('perm_site_admin !=' => 1, 'perm_sync !=' => 1, 'perm_regexp_access !=' => 1));
+            $params = array('conditions' => array('perm_site_admin !=' => 1, 'perm_sync !=' => 1, 'perm_regexp_access !=' => 1, 'restricted_to_site_admin' => 0));
         }
         $this->loadModel('AdminSetting');
         $default_role_id = $this->AdminSetting->getSetting('default_role');
         $roles = $this->User->Role->find('list', $params);
         $syncRoles = $this->User->Role->find('list', array('conditions' => array('perm_sync' => 1), 'recursive' => -1));
@@ -948,11 +948,20 @@ class UsersController extends AppController
                 }
                 if (!$this->_isSiteAdmin() && isset($this->request->data['User']['role_id'])) {
                     $chosenRole = $this->User->Role->find('first', [
                         'conditions' => ['id' => $this->request->data['User']['role_id']],
                     ]);
-                    if (empty($chosenRole) || (($chosenRole['Role']['id'] != $allowedRole) && ($chosenRole['Role']['perm_site_admin'] == 1 || $chosenRole['Role']['perm_regexp_access'] == 1 || $chosenRole['Role']['perm_sync'] == 1))) {
+                    if (
+                        empty($chosenRole) ||
+                        (
+                            ($chosenRole['Role']['id'] != $allowedRole) && 
+                            ($chosenRole['Role']['perm_site_admin'] == 1 ||
+                            $chosenRole['Role']['perm_regexp_access'] == 1 ||
+                            $chosenRole['Role']['perm_sync'] == 1) ||
+                            $chosenRole['Role']['restricted_to_site_admin'] == 1
+                        )
+                    ) {
                         throw new Exception('You are not authorised to assign that role to a user.');
                     }
                 }
                 $fields[] = 'date_modified'; // time will be inserted in `beforeSave` action
 

Vulnerable code:             $params = array('conditions' => array('perm_site_admin !=' => 1, 'perm_sync !=' => 1, 'perm_regexp_access !=' => 1));
                    if (empty($chosenRole) || (($chosenRole['Role']['id'] != $allowedRole) && ($chosenRole['Role']['perm_site_admin'] == 1 || $chosenRole['Role']['perm_regexp_access'] == 1 || $chosenRole['Role']['perm_sync'] == 1))) {
Fixed code:             $params = array('conditions' => array('perm_site_admin !=' => 1, 'perm_sync !=' => 1, 'perm_regexp_access !=' => 1, 'restricted_to_site_admin' => 0));
                    if (
                        empty($chosenRole) ||
                        (
                            ($chosenRole['Role']['id'] != $allowedRole) && 
                            ($chosenRole['Role']['perm_site_admin'] == 1 ||
                            $chosenRole['Role']['perm_regexp_access'] == 1 ||
                            $chosenRole['Role']['perm_sync'] == 1) ||
                            $chosenRole['Role']['restricted_to_site_admin'] == 1
                        )
                    ) {