CVE-2020-36660: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. Upgrading to version 0.12.12 is able to address this issue. The patch is named 9e03f68e46e85ca9c9694a6971859b3ee66f0240. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220211.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 4.3
Published: 2023-02-06T17:15Z
Repository: https://github.com/paxswill/evesrp
Language: Python
Files changed: src/evesrp/views/api.py
Commit date: 2020-10-13 14:44:08 -0400
Commit message: Security Vuln: Check API access to entity details

Access through the /api/user/<id> and /api/group/<id> routes were not
properly being checked. This meant that anyone could easily enumerate
users and groups.

User information disclosed would include which SRP groups a user is
in, whether they are an admin, which permissions a user has been
granted, as well as the details for every SRP request that user has
submitted, including the character name for the loss. The authentication
source (Test Auth, EVE SSO, etc) for the user would also be disclosed
through the requests, along with the ID associated with that
authentication method.

Group information disclosed would include the group name, permissions
granted within that group, as well as all members of the group.

v0.12.2 is going to be released shortly addressing this vulnerability.
A large thank you to the individual who brought this to my attention.

Diff: diff --git a/src/evesrp/views/api.py b/src/evesrp/views/api.py
index 817dc80..553725a 100644
--- a/src/evesrp/views/api.py
+++ b/src/evesrp/views/api.py
@@ -55,11 +55,15 @@ def list_entities():
             u'source': e.authmethod}, group_query)
     return jsonify(entities=chain(users, groups))
 
 
 @api.route('/user/<int:user_id>/')
+@login_required
 def user_detail(user_id):
+    if not current_user.admin and not \
+            current_user.has_permission(PermissionType.admin):
+        abort(403)
     user = User.query.get_or_404(user_id)
     # Set up divisions
     submit = map(lambda p: p.division,
             filter(lambda p: p.permission == PermissionType.submit,
                 user.permissions))
@@ -82,11 +86,15 @@ def user_detail(user_id):
     }
     return jsonify(**resp)
 
 
 @api.route('/group/<int:group_id>/')
+@login_required
 def group_detail(group_id):
+    if not current_user.admin and not \
+            current_user.has_permission(PermissionType.admin):
+        abort(403)
     group = Group.query.get_or_404(group_id)
     submit = map(lambda p: p.division,
             filter(lambda p: p.permission == PermissionType.submit,
                 group.permissions))
     review = map(lambda p: p.division,

Fixed code: @login_required
    if not current_user.admin and not \
            current_user.has_permission(PermissionType.admin):
        abort(403)
@login_required
    if not current_user.admin and not \
            current_user.has_permission(PermissionType.admin):
        abort(403)