CVE-2021-3813: Authorization Bypass Through User-Controlled Key (CWE-639)
value: Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 6.5
Published: 2022-02-09T15:15Z
Repository: https://github.com/chatwoot/chatwoot
Language: Ruby
Files changed: app/finders/conversation_finder.rb, spec/finders/conversation_finder_spec.rb
Commit date: 2022-02-03 18:25:28 -0800
Commit message: Fix: Conversation filter permissions (#3908)

fixes: chatwoot/product#225
Diff: diff --git a/app/finders/conversation_finder.rb b/app/finders/conversation_finder.rb
index 3409a2450..58013f128 100644
--- a/app/finders/conversation_finder.rb
+++ b/app/finders/conversation_finder.rb
@@ -53,11 +53,11 @@ class ConversationFinder
     filter_by_query if params[:q]
   end
 
   def set_inboxes
     @inbox_ids = if params[:inbox_id]
-                   current_account.inboxes.where(id: params[:inbox_id])
+                   @current_user.assigned_inboxes.where(id: params[:inbox_id])
                  else
                    @current_user.assigned_inboxes.pluck(:id)
                  end
   end
 
diff --git a/spec/finders/conversation_finder_spec.rb b/spec/finders/conversation_finder_spec.rb
index 67b526b64..906c0e3f2 100644
--- a/spec/finders/conversation_finder_spec.rb
+++ b/spec/finders/conversation_finder_spec.rb
@@ -4,11 +4,13 @@ describe ::ConversationFinder do
   subject(:conversation_finder) { described_class.new(user_1, params) }
 
   let!(:account) { create(:account) }
   let!(:user_1) { create(:user, account: account) }
   let!(:user_2) { create(:user, account: account) }
+  let!(:admin) { create(:user, account: account, role: :administrator) }
   let!(:inbox) { create(:inbox, account: account, enable_auto_assignment: false) }
+  let!(:restricted_inbox) { create(:inbox, account: account) }
 
   before do
     create(:inbox_member, user: user_1, inbox: inbox)
     create(:inbox_member, user: user_2, inbox: inbox)
     create(:conversation, account: account, inbox: inbox, assignee: user_1)
@@ -28,10 +30,36 @@ describe ::ConversationFinder do
         result = conversation_finder.perform
         expect(result[:conversations].length).to be 2
       end
     end
 
+    context 'with inbox' do
+      let!(:restricted_conversation) { create(:conversation, account: account, inbox_id: restricted_inbox.id) }
+
+      it 'returns conversation from any inbox if its admin' do
+        params = { inbox_id: restricted_inbox.id }
+        result = described_class.new(admin, params).perform
+
+        expect(result[:conversations].map(&:id)).to include(restricted_conversation.id)
+      end
+
+      it 'returns conversation from inbox if agent is its member' do
+        params = { inbox_id: restricted_inbox.id }
+        create(:inbox_member, user: user_1, inbox: restricted_inbox)
+        result = described_class.new(user_1, params).perform
+
+        expect(result[:conversations].map(&:id)).to include(restricted_conversation.id)
+      end
+
+      it 'does not return conversations from inboxes where agent is not a member' do
+        params = { inbox_id: restricted_inbox.id }
+        result = described_class.new(user_1, params).perform
+
+        expect(result[:conversations].map(&:id)).not_to include(restricted_conversation.id)
+      end
+    end
+
     context 'with assignee_type all' do
       let(:params) { { assignee_type: 'all' } }
 
       it 'filter conversations by assignee type all' do
         result = conversation_finder.perform

Vulnerable code:                    current_account.inboxes.where(id: params[:inbox_id])
Fixed code:                    @current_user.assigned_inboxes.where(id: params[:inbox_id])
  let!(:admin) { create(:user, account: account, role: :administrator) }
  let!(:restricted_inbox) { create(:inbox, account: account) }
    context 'with inbox' do
      let!(:restricted_conversation) { create(:conversation, account: account, inbox_id: restricted_inbox.id) }

      it 'returns conversation from any inbox if its admin' do
        params = { inbox_id: restricted_inbox.id }
        result = described_class.new(admin, params).perform

        expect(result[:conversations].map(&:id)).to include(restricted_conversation.id)
      end

      it 'returns conversation from inbox if agent is its member' do
        params = { inbox_id: restricted_inbox.id }
        create(:inbox_member, user: user_1, inbox: restricted_inbox)
        result = described_class.new(user_1, params).perform

        expect(result[:conversations].map(&:id)).to include(restricted_conversation.id)
      end

      it 'does not return conversations from inboxes where agent is not a member' do
        params = { inbox_id: restricted_inbox.id }
        result = described_class.new(user_1, params).perform

        expect(result[:conversations].map(&:id)).not_to include(restricted_conversation.id)
      end
    end