CVE-2022-2901: Improper Authorization (CWE-285)
value: Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 7.1
Published: 2022-09-06T10:15Z
Repository: https://github.com/chatwoot/chatwoot
Language: Ruby
Files changed: app/controllers/api/v1/accounts/team_members_controller.rb, spec/controllers/api/v1/accounts/team_members_controller_spec.rb
Commit date: 2022-09-02 23:09:29 +0530
Commit message: fix: Validations for updating team members (#5384)

fixes: chatwoot/product#539

Co-authored-by: Sojan Jose <sojan@pepalo.com>
Diff: diff --git a/app/controllers/api/v1/accounts/team_members_controller.rb b/app/controllers/api/v1/accounts/team_members_controller.rb
index 19a46b6079..0243a915a4 100644
--- a/app/controllers/api/v1/accounts/team_members_controller.rb
+++ b/app/controllers/api/v1/accounts/team_members_controller.rb
@@ -1,8 +1,9 @@
 class Api::V1::Accounts::TeamMembersController < Api::V1::Accounts::BaseController
   before_action :fetch_team
   before_action :check_authorization
+  before_action :validate_member_id_params, only: [:create, :update, :destroy]
 
   def index
     @team_members = @team.team_members.map(&:user)
   end
 
@@ -43,6 +44,12 @@ class Api::V1::Accounts::TeamMembersController < Api::V1::Accounts::BaseControll
   end
 
   def fetch_team
     @team = Current.account.teams.find(params[:team_id])
   end
+
+  def validate_member_id_params
+    invalid_ids = params[:user_ids].map(&:to_i) - @team.account.user_ids
+
+    render json: { error: 'Invalid User IDs' }, status: :unauthorized and return if invalid_ids.present?
+  end
 end
diff --git a/spec/controllers/api/v1/accounts/team_members_controller_spec.rb b/spec/controllers/api/v1/accounts/team_members_controller_spec.rb
index 967b8e79cc..6643244c2f 100644
--- a/spec/controllers/api/v1/accounts/team_members_controller_spec.rb
+++ b/spec/controllers/api/v1/accounts/team_members_controller_spec.rb
@@ -1,9 +1,10 @@
 require 'rails_helper'
 
 RSpec.describe 'Team Members API', type: :request do
   let(:account) { create(:account) }
+  let(:account_2) { create(:account) }
   let!(:team) { create(:team, account: account) }
 
   describe 'GET /api/v1/accounts/{account.id}/teams/{team_id}/team_members' do
     context 'when it is an unauthenticated user' do
       it 'returns unauthorized' do
@@ -118,10 +119,11 @@ RSpec.describe 'Team Members API', type: :request do
       end
     end
 
     context 'when it is an authenticated user' do
       let(:agent) { create(:user, account: account, role: :agent) }
+      let(:agent_2) { create(:user, account: account_2, role: :agent) }
       let(:administrator) { create(:user, account: account, role: :administrator) }
 
       it 'return unauthorized for agent' do
         params = { user_id: agent.id }
         patch "/api/v1/accounts/#{account.id}/teams/#{team.id}/team_members",
@@ -143,8 +145,21 @@ RSpec.describe 'Team Members API', type: :request do
 
         expect(response).to have_http_status(:success)
         json_response = JSON.parse(response.body)
         expect(json_response.count).to eq(user_ids.count)
       end
+
+      it 'ignores the user ids when its not a valid account user id' do
+        params = { user_ids: [agent_2.id] }
+
+        patch "/api/v1/accounts/#{account.id}/teams/#{team.id}/team_members",
+              params: params,
+              headers: administrator.create_new_auth_token,
+              as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+        json_response = JSON.parse(response.body)
+        expect(json_response['error']).to eq('Invalid User IDs')
+      end
     end
   end
 end

Fixed code:   before_action :validate_member_id_params, only: [:create, :update, :destroy]

  def validate_member_id_params
    invalid_ids = params[:user_ids].map(&:to_i) - @team.account.user_ids

    render json: { error: 'Invalid User IDs' }, status: :unauthorized and return if invalid_ids.present?
  end
  let(:account_2) { create(:account) }
      let(:agent_2) { create(:user, account: account_2, role: :agent) }

      it 'ignores the user ids when its not a valid account user id' do
        params = { user_ids: [agent_2.id] }

        patch "/api/v1/accounts/#{account.id}/teams/#{team.id}/team_members",
              params: params,
              headers: administrator.create_new_auth_token,
              as: :json

        expect(response).to have_http_status(:unauthorized)
        json_response = JSON.parse(response.body)
        expect(json_response['error']).to eq('Invalid User IDs')
      end