CVE-2022-1155: Insufficient Information (NVD-CWE-noinfo)
value: Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.4
Published: 2022-03-30T13:15Z
Repository: https://github.com/snipe/snipe-it
Language: PHP
Files changed: app/Http/Kernel.php, app/Http/Middleware/CheckUserIsActivated.php, resources/lang/en/auth/message.php
Commit date: 2022-03-29 13:44:53 +0100
Commit message: Logout user when their activated status is switched to off

Signed-off-by: snipe <snipe@snipe.net>

Diff: diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index f94d390d762..ea635de505a 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -37,10 +37,11 @@ class Kernel extends HttpKernel
         'web' => [
             \App\Http\Middleware\EncryptCookies::class,
             \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
             \App\Http\Middleware\VerifyCsrfToken::class,
             \App\Http\Middleware\CheckLocale::class,
+            \App\Http\Middleware\CheckUserIsActivated::class,
             \App\Http\Middleware\CheckForTwoFactor::class,
             \Laravel\Passport\Http\Middleware\CreateFreshApiToken::class,
             \App\Http\Middleware\AssetCountForSidebar::class,
         ],
 
diff --git a/app/Http/Middleware/Authenticate.php b/app/Http/Middleware/CheckUserIsActivated.php
similarity index 60%
rename from app/Http/Middleware/Authenticate.php
rename to app/Http/Middleware/CheckUserIsActivated.php
index 2ac322ff290..9872e99541d 100644
--- a/app/Http/Middleware/Authenticate.php
+++ b/app/Http/Middleware/CheckUserIsActivated.php
@@ -2,12 +2,13 @@
 
 namespace App\Http\Middleware;
 
 use Closure;
 use Illuminate\Contracts\Auth\Guard;
+use Auth;
 
-class Authenticate
+class CheckUserIsActivated
 {
     /**
      * The Guard implementation.
      *
      * @var Guard
@@ -32,16 +33,18 @@ class Authenticate
      * @param  \Closure  $next
      * @return mixed
      */
     public function handle($request, Closure $next)
     {
-        if ($this->auth->guest()) {
-            if ($request->ajax()) {
-                return response('Unauthorized.', 401);
-            } else {
-                return redirect()->guest('login');
-            }
+
+        // If there is a user AND the user is NOT activated, send them to the login page
+        // This prevents people who still have active sessions logged in and their status gets toggled
+        // to inactive (aka unable to login)
+        if (($request->user()) && (!$request->user()->isActivated())) {
+            Auth::logout();
+            return redirect()->guest('login');
         }
 
         return $next($request);
+
     }
 }
diff --git a/resources/lang/en/auth/message.php b/resources/lang/en/auth/message.php
index f086d8c04c3..507dfad15a1 100644
--- a/resources/lang/en/auth/message.php
+++ b/resources/lang/en/auth/message.php
@@ -1,11 +1,11 @@
 <?php
 
 return array(
 
     'account_already_exists' => 'An account with the this email already exists.',
-    'account_not_found'      => 'The username or password is incorrect.',
+    'account_not_found'      => 'The username or password is incorrect or this user is not approved to login.',
     'account_not_activated'  => 'This user account is not activated.',
     'account_suspended'      => 'This user account is suspended.',
     'account_banned'         => 'This user account is banned.',
     'throttle'               => 'Too many failed login attempts. Please try again in :minutes minutes.',
 

Vulnerable code: class Authenticate
        if ($this->auth->guest()) {
            if ($request->ajax()) {
                return response('Unauthorized.', 401);
            } else {
                return redirect()->guest('login');
            }
    'account_not_found'      => 'The username or password is incorrect.',
Fixed code:             \App\Http\Middleware\CheckUserIsActivated::class,
use Auth;
class CheckUserIsActivated

        // If there is a user AND the user is NOT activated, send them to the login page
        // This prevents people who still have active sessions logged in and their status gets toggled
        // to inactive (aka unable to login)
        if (($request->user()) && (!$request->user()->isActivated())) {
            Auth::logout();
            return redirect()->guest('login');

    'account_not_found'      => 'The username or password is incorrect or this user is not approved to login.',