CVE-2022-39214: Incorrect Authorization (CWE-863)
value: Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0.2-1.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 7.5
Published: 2023-03-14T16:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: application/loginbasic.class.inc.php, application/loginexternal.class.inc.php, application/loginform.class.inc.php, application/loginurl.class.inc.php
Commit date: 2022-12-08 08:21:13 +0100
Commit message: N°5394 - use session for the FSM (use Session object)

Diff: diff --git a/application/loginbasic.class.inc.php b/application/loginbasic.class.inc.php
index 76ce4ae309..68f8eeaf66 100644
--- a/application/loginbasic.class.inc.php
+++ b/application/loginbasic.class.inc.php
@@ -57,11 +57,10 @@ class LoginBasic extends AbstractLoginFSMExtension
 		if (Session::Get('login_mode') == 'basic')
 		{
 			list($sAuthUser, $sAuthPwd) = $this->GetAuthUserAndPassword();
 			if (!UserRights::CheckCredentials($sAuthUser, $sAuthPwd, Session::Get('login_mode'), 'internal'))
 			{
-				$_SESSION['auth_user'] = $sAuthUser;
 				$iErrorCode = LoginWebPage::EXIT_CODE_WRONGCREDENTIALS;
 				return LoginWebPage::LOGIN_FSM_ERROR;
 			}
 			Session::Set('auth_user', $sAuthUser);
 		}
diff --git a/application/loginexternal.class.inc.php b/application/loginexternal.class.inc.php
index 6cc3132518..a666c0de53 100644
--- a/application/loginexternal.class.inc.php
+++ b/application/loginexternal.class.inc.php
@@ -40,11 +40,10 @@ class LoginExternal extends AbstractLoginFSMExtension
 		if (Session::Get('login_mode') == 'external')
 		{
 			$sAuthUser = $this->GetAuthUser();
 			if (!UserRights::CheckCredentials($sAuthUser, '', Session::Get('login_mode'), 'external'))
 			{
-				$_SESSION['auth_user'] = $sAuthUser;
 				$iErrorCode = LoginWebPage::EXIT_CODE_WRONGCREDENTIALS;
 				return LoginWebPage::LOGIN_FSM_ERROR;
 			}
 			Session::Set('auth_user', $sAuthUser);
 		}
diff --git a/application/loginform.class.inc.php b/application/loginform.class.inc.php
index 9030fbe77e..d8e5bc8ee4 100644
--- a/application/loginform.class.inc.php
+++ b/application/loginform.class.inc.php
@@ -66,11 +66,10 @@ class LoginForm extends AbstractLoginFSMExtension implements iLoginUIExtension
 		{
 			$sAuthUser = utils::ReadPostedParam('auth_user', '', 'raw_data');
 			$sAuthPwd = utils::ReadPostedParam('auth_pwd', null, 'raw_data');
 			if (!UserRights::CheckCredentials($sAuthUser, $sAuthPwd, Session::Get('login_mode'), 'internal'))
 			{
-				$_SESSION['auth_user'] = $sAuthUser;
 				$iErrorCode = LoginWebPage::EXIT_CODE_WRONGCREDENTIALS;
 				return LoginWebPage::LOGIN_FSM_ERROR;
 			}
 			Session::Set('auth_user', $sAuthUser);
 		}
diff --git a/application/loginurl.class.inc.php b/application/loginurl.class.inc.php
index 94a25924f2..364f07c32a 100644
--- a/application/loginurl.class.inc.php
+++ b/application/loginurl.class.inc.php
@@ -55,11 +55,10 @@ class LoginURL extends AbstractLoginFSMExtension
 		{
 			$sAuthUser = utils::ReadParam('auth_user', '', false, 'raw_data');
 			$sAuthPwd = utils::ReadParam('auth_pwd', null, false, 'raw_data');
 			if (!UserRights::CheckCredentials($sAuthUser, $sAuthPwd, Session::Get('login_mode'), 'internal'))
 			{
-				$_SESSION['auth_user'] = $sAuthUser;
 				$iErrorCode = LoginWebPage::EXIT_CODE_WRONGCREDENTIALS;
 				return LoginWebPage::LOGIN_FSM_ERROR;
 			}
 			Session::Set('auth_user', $sAuthUser);
 		}

Vulnerable code: 				$_SESSION['auth_user'] = $sAuthUser;
				$_SESSION['auth_user'] = $sAuthUser;
				$_SESSION['auth_user'] = $sAuthUser;
				$_SESSION['auth_user'] = $sAuthUser;