CVE-2017-12851: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 8.8
Published: 2017-08-14T20:29Z
Repository: https://github.com/kanboard/kanboard
Language: PHP
Files changed: app/Controller/UserCredentialController.php, app/Controller/UserModificationController.php
Commit date: 2017-08-11 22:18:53 -0700
Commit message: Filter variables when updating user profile

Diff: diff --git a/app/Controller/UserCredentialController.php b/app/Controller/UserCredentialController.php
index ae52a13c4..a8b90b7b8 100644
--- a/app/Controller/UserCredentialController.php
+++ b/app/Controller/UserCredentialController.php
@@ -42,11 +42,15 @@ class UserCredentialController extends BaseController
         $values = $this->request->getValues();
 
         list($valid, $errors) = $this->userValidator->validatePasswordModification($values);
 
         if (! $this->userSession->isAdmin()) {
-            $values['id'] = $this->userSession->getId();
+            $values = array(
+                'id' => $this->userSession->getId(),
+                'password' => isset($values['password']) ? $values['password'] : '',
+                'confirmation' => isset($values['confirmation']) ? $values['confirmation'] : '',
+            );
         }
 
         if ($valid) {
             if ($this->userModel->update($values)) {
                 $this->flash->success(t('Password modified successfully.'));
diff --git a/app/Controller/UserModificationController.php b/app/Controller/UserModificationController.php
index ed1459212..f4916f6f4 100644
--- a/app/Controller/UserModificationController.php
+++ b/app/Controller/UserModificationController.php
@@ -45,13 +45,18 @@ class UserModificationController extends BaseController
     {
         $user = $this->getUser();
         $values = $this->request->getValues();
 
         if (! $this->userSession->isAdmin()) {
-            if (isset($values['role'])) {
-                unset($values['role']);
-            }
+            $values = array(
+                'id' => $this->userSession->getId(),
+                'username' => isset($values['username']) ? $values['username'] : '',
+                'name' => isset($values['name']) ? $values['name'] : '',
+                'email' => isset($values['email']) ? $values['email'] : '',
+                'timezone' => isset($values['timezone']) ? $values['timezone'] : '',
+                'language' => isset($values['language']) ? $values['language'] : '',
+            );
         }
 
         list($valid, $errors) = $this->userValidator->validateModification($values);
 
         if ($valid) {

Vulnerable code:             $values['id'] = $this->userSession->getId();
            if (isset($values['role'])) {
                unset($values['role']);
            }
Fixed code:             $values = array(
                'id' => $this->userSession->getId(),
                'password' => isset($values['password']) ? $values['password'] : '',
                'confirmation' => isset($values['confirmation']) ? $values['confirmation'] : '',
            );
            $values = array(
                'id' => $this->userSession->getId(),
                'username' => isset($values['username']) ? $values['username'] : '',
                'name' => isset($values['name']) ? $values['name'] : '',
                'email' => isset($values['email']) ? $values['email'] : '',
                'timezone' => isset($values['timezone']) ? $values['timezone'] : '',
                'language' => isset($values['language']) ? $values['language'] : '',
            );