CVE-2024-24539: Insufficient Information (NVD-CWE-noinfo)
value: FusionPBX before 5.2.0 does not validate a session.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-18T03:15Z
Repository: https://github.com/fusionpbx/fusionpbx
Language: PHP
Files changed: core/authentication/resources/classes/authentication.php, resources/check_auth.php
Commit date: 2024-01-22 14:20:28 -0700
Commit message: Security - validate session
Diff: diff --git a/core/authentication/resources/classes/authentication.php b/core/authentication/resources/classes/authentication.php
index ab0355aec5..9378a14844 100644
--- a/core/authentication/resources/classes/authentication.php
+++ b/core/authentication/resources/classes/authentication.php
@@ -227,18 +227,21 @@ class authentication {
 					$_SESSION["domain_uuid"] = $result["domain_uuid"];
 					//$_SESSION["domain_name"] = $result["domain_name"];
 					$_SESSION["user_uuid"] = $result["user_uuid"];
 					$_SESSION["context"] = $result['domain_name'];
 
+				//used to validate the session
+					$_SESSION["user_hash"] = hash('sha256', $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT']);
+
 				//user session array
 					$_SESSION["user"]["domain_uuid"] = $result["domain_uuid"];
 					$_SESSION["user"]["domain_name"] = $result["domain_name"];
 					$_SESSION["user"]["user_uuid"] = $result["user_uuid"];
 					$_SESSION["user"]["username"] = $result["username"];
 					$_SESSION["user"]["contact_uuid"] = $result["contact_uuid"];
 
-				//get the groups assigned to the user 
+				//get the groups assigned to the user
 					$group = new groups;
 					$group->session($result["domain_uuid"], $result["user_uuid"]);
 
 				//get the permissions assigned to the user through the assigned groups
 					$permission = new permissions;
diff --git a/resources/check_auth.php b/resources/check_auth.php
index 66cf392292..5232247c27 100644
--- a/resources/check_auth.php
+++ b/resources/check_auth.php
@@ -35,11 +35,11 @@
 	if (version_compare(phpversion(), '5.5', '<')) {
 		require_once "resources/functions/password.php";
 	}
 
 //start the session
-	if (function_exists('session_start')) { 
+	if (function_exists('session_start')) {
 		if (!isset($_SESSION)) {
 			session_start();
 		}
 	}
 
@@ -68,12 +68,23 @@
 	}
 
 //define variables
 	if (!isset($_SESSION['template_content'])) { $_SESSION["template_content"] = null; }
 
+//if session authorized is not set then set the default value to false
+	if (!isset($_SESSION['authorized'])) {
+		$_SESSION['authorized'] = false;
+	}
+
+//validate the session address
+	if ($_SESSION['authorized'] && $_SESSION["user_hash"] !== hash('sha256', $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'])) {
+		session_destroy();
+		header("Location: ".PROJECT_PATH."/?path=".urlencode($target_path));
+	}
+
 //if the session is not authorized then verify the identity
-	if (!isset($_SESSION['authorized']) || (isset($_SESSION['authorized']) && !$_SESSION['authorized'])) {
+	if (!$_SESSION['authorized']) {
 
 		//clear the menu
 			unset($_SESSION["menu"]);
 
 		//clear the template only if the template has not been assigned by the superadmin

Vulnerable code: 				//get the groups assigned to the user 
	if (function_exists('session_start')) { 
	if (!isset($_SESSION['authorized']) || (isset($_SESSION['authorized']) && !$_SESSION['authorized'])) {
Fixed code: 				//used to validate the session
					$_SESSION["user_hash"] = hash('sha256', $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT']);

				//get the groups assigned to the user
	if (function_exists('session_start')) {
//if session authorized is not set then set the default value to false
	if (!isset($_SESSION['authorized'])) {
		$_SESSION['authorized'] = false;
	}

//validate the session address
	if ($_SESSION['authorized'] && $_SESSION["user_hash"] !== hash('sha256', $_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'])) {
		session_destroy();
		header("Location: ".PROJECT_PATH."/?path=".urlencode($target_path));
	}

	if (!$_SESSION['authorized']) {