CVE-2023-32310: Authorization Bypass Through User-Controlled Key (CWE-639)
value: DataEase is an open source data visualization and analysis tool. The API interface for DataEase delete dashboard and delete system messages is vulnerable to insecure direct object references (IDOR). This could result in a user deleting another user's dashboard or messages or interfering with the interface for marking messages read. The vulnerability has been fixed in v1.18.7. There are no known workarounds aside from upgrading.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 8.1
Published: 2023-06-01T16:15Z
Repository: https://github.com/dataease/dataease
Language: Java
Files changed: backend/src/main/java/io/dataease/service/panel/ShareService.java
Commit date: 2023-05-29 10:01:43 +0800
Commit message: feat(仪表板): 删除分享IDOR漏洞

Diff: diff --git a/backend/src/main/java/io/dataease/service/panel/ShareService.java b/backend/src/main/java/io/dataease/service/panel/ShareService.java
index 143959f23..f11ba695a 100644
--- a/backend/src/main/java/io/dataease/service/panel/ShareService.java
+++ b/backend/src/main/java/io/dataease/service/panel/ShareService.java
@@ -2,24 +2,24 @@ package io.dataease.service.panel;
 
 import com.google.gson.Gson;
 import io.dataease.auth.api.dto.CurrentRoleDto;
 import io.dataease.auth.api.dto.CurrentUserDto;
 import io.dataease.commons.constants.SysLogConstants;
-import io.dataease.commons.utils.DeLogUtils;
-import io.dataease.ext.ExtPanelShareMapper;
 import io.dataease.commons.model.AuthURD;
 import io.dataease.commons.utils.AuthUtils;
 import io.dataease.commons.utils.BeanUtils;
 import io.dataease.commons.utils.CommonBeanFactory;
+import io.dataease.commons.utils.DeLogUtils;
 import io.dataease.controller.request.panel.PanelShareFineDto;
 import io.dataease.controller.request.panel.PanelShareRemoveRequest;
 import io.dataease.controller.request.panel.PanelShareRequest;
 import io.dataease.controller.request.panel.PanelShareSearchRequest;
 import io.dataease.controller.sys.base.BaseGridRequest;
 import io.dataease.dto.panel.PanelShareDto;
 import io.dataease.dto.panel.PanelShareOutDTO;
 import io.dataease.dto.panel.PanelSharePo;
+import io.dataease.ext.ExtPanelShareMapper;
 import io.dataease.plugins.common.base.domain.PanelGroup;
 import io.dataease.plugins.common.base.domain.PanelShare;
 import io.dataease.plugins.common.base.domain.PanelShareExample;
 import io.dataease.plugins.common.base.mapper.PanelGroupMapper;
 import io.dataease.plugins.common.base.mapper.PanelShareMapper;
@@ -388,12 +388,15 @@ public class ShareService {
     public void removeSharesyPanel(String panelId) {
         PanelGroup panelGroup = panelGroupMapper.selectByPrimaryKey(panelId);
         PanelShareRemoveRequest request = new PanelShareRemoveRequest();
         request.setPanelId(panelId);
         List<PanelShareOutDTO> panelShareOutDTOS = queryTargets(panelId);
+        if (CollectionUtils.isEmpty(panelShareOutDTOS) || ObjectUtils.isEmpty(panelGroup)) {
+            return;
+        }
         extPanelShareMapper.removeShares(request);
-        if (CollectionUtils.isEmpty(panelShareOutDTOS) || ObjectUtils.isEmpty(panelGroup) || StringUtils.isBlank(panelGroup.getName())) {
+        if (StringUtils.isBlank(panelGroup.getName())) {
             return;
         }
         panelShareOutDTOS.forEach(shareOut -> {
             SysLogConstants.SOURCE_TYPE buiType = buiType(shareOut.getType());
             DeLogUtils.save(SysLogConstants.OPERATE_TYPE.UNSHARE, SysLogConstants.SOURCE_TYPE.PANEL, panelId, panelGroup.getPid(), shareOut.getTargetId(), buiType);

Vulnerable code: import io.dataease.commons.utils.DeLogUtils;
import io.dataease.ext.ExtPanelShareMapper;
        if (CollectionUtils.isEmpty(panelShareOutDTOS) || ObjectUtils.isEmpty(panelGroup) || StringUtils.isBlank(panelGroup.getName())) {
Fixed code: import io.dataease.commons.utils.DeLogUtils;
import io.dataease.ext.ExtPanelShareMapper;
        if (CollectionUtils.isEmpty(panelShareOutDTOS) || ObjectUtils.isEmpty(panelGroup)) {
            return;
        }
        if (StringUtils.isBlank(panelGroup.getName())) {