CVE-2022-1770: Improper Privilege Management (CWE-269)
value: Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 8.8
Published: 2022-05-20T18:15Z
Repository: https://github.com/polonel/trudesk
Language: JavaScript
Files changed: src/controllers/api/v2/routes.js
Commit date: 2022-05-20 01:17:24 -0400
Commit message: refactor(core): apiv2 route enhancements
Diff: diff --git a/src/controllers/api/v2/routes.js b/src/controllers/api/v2/routes.js
index 62cb61d25..f268a721c 100644
--- a/src/controllers/api/v2/routes.js
+++ b/src/controllers/api/v2/routes.js
@@ -6,11 +6,11 @@
  *    888    888      888   888  888   888  888ooo888 `"Y88b.   888888.
  *    888 .  888      888   888  888   888  888    .o o.  )88b  888 `88b.
  *    "888" d888b     `V88V"V8P' `Y8bod88P" `Y8bod8P' 8""888P' o888o o888o
  *  ========================================================================
  *  Author:     Chris Brame
- *  Updated:    2/14/19 12:07 AM
+ *  Updated:    5/17/22 2:15 PM
  *  Copyright (c) 2014-2019. All rights reserved.
  */
 
 module.exports = function (middleware, router, controllers) {
   // Shorten Vars
@@ -24,41 +24,41 @@ module.exports = function (middleware, router, controllers) {
   // Common
   router.post('/api/v2/login', controllers.api.v2.common.login)
   router.post('/api/v2/token', controllers.api.v2.common.token)
 
   // Accounts
-  router.get('/api/v2/accounts', apiv2Auth, apiv2.accounts.get)
-  router.post('/api/v2/accounts', apiv2Auth, apiv2.accounts.create)
-  router.put('/api/v2/accounts/:username', apiv2Auth, apiv2.accounts.update)
+  router.get('/api/v2/accounts', apiv2Auth, canUser('accounts:view'), apiv2.accounts.get)
+  router.post('/api/v2/accounts', apiv2Auth, canUser('accounts:create'), apiv2.accounts.create)
+  router.put('/api/v2/accounts/:username', canUser('accounts:update'), apiv2Auth, apiv2.accounts.update)
 
   // Tickets
-  router.get('/api/v2/tickets', apiv2Auth, apiv2.tickets.get)
-  router.post('/api/v2/tickets', apiv2Auth, apiv2.tickets.create)
+  router.get('/api/v2/tickets', apiv2Auth, canUser('tickets:view'), apiv2.tickets.get)
+  router.post('/api/v2/tickets', apiv2Auth, canUser('tickets:create'), apiv2.tickets.create)
   router.post('/api/v2/tickets/transfer/:uid', apiv2Auth, isAdmin, apiv2.tickets.transferToThirdParty)
-  router.get('/api/v2/tickets/:uid', apiv2Auth, apiv2.tickets.single)
-  router.put('/api/v2/tickets/batch', apiv2Auth, apiv2.tickets.batchUpdate)
-  router.put('/api/v2/tickets/:uid', apiv2Auth, apiv2.tickets.update)
-  router.delete('/api/v2/tickets/:uid', apiv2Auth, apiv2.tickets.delete)
+  router.get('/api/v2/tickets/:uid', apiv2Auth, canUser('tickets:view'), apiv2.tickets.single)
+  router.put('/api/v2/tickets/batch', apiv2Auth, canUser('tickets:update'), apiv2.tickets.batchUpdate)
+  router.put('/api/v2/tickets/:uid', apiv2Auth, canUser('tickets:update'), apiv2.tickets.update)
+  router.delete('/api/v2/tickets/:uid', apiv2Auth, canUser('tickets:delete'), apiv2.tickets.delete)
   router.delete('/api/v2/tickets/deleted/:id', apiv2Auth, isAdmin, apiv2.tickets.permDelete)
 
   // Groups
   router.get('/api/v2/groups', apiv2Auth, apiv2.groups.get)
-  router.post('/api/v2/groups', apiv2Auth, apiv2.groups.create)
-  router.put('/api/v2/groups/:id', apiv2Auth, apiv2.groups.update)
-  router.delete('/api/v2/groups/:id', apiv2Auth, apiv2.groups.delete)
+  router.post('/api/v2/groups', apiv2Auth, canUser('groups:create'), apiv2.groups.create)
+  router.put('/api/v2/groups/:id', apiv2Auth, canUser('groups:update'), apiv2.groups.update)
+  router.delete('/api/v2/groups/:id', apiv2Auth, canUser('groups:delete'), apiv2.groups.delete)
 
   // Teams
-  router.get('/api/v2/teams', apiv2Auth, apiv2.teams.get)
-  router.post('/api/v2/teams', apiv2Auth, apiv2.teams.create)
-  router.put('/api/v2/teams/:id', apiv2Auth, apiv2.teams.update)
-  router.delete('/api/v2/teams/:id', apiv2Auth, apiv2.teams.delete)
+  router.get('/api/v2/teams', apiv2Auth, canUser('teams:view'), apiv2.teams.get)
+  router.post('/api/v2/teams', apiv2Auth, canUser('teams:create'), apiv2.teams.create)
+  router.put('/api/v2/teams/:id', apiv2Auth, canUser('teams:update'), apiv2.teams.update)
+  router.delete('/api/v2/teams/:id', apiv2Auth, canUser('teams:delete'), apiv2.teams.delete)
 
   // Departments
-  router.get('/api/v2/departments', apiv2Auth, apiv2.departments.get)
-  router.post('/api/v2/departments', apiv2Auth, apiv2.departments.create)
-  router.put('/api/v2/departments/:id', apiv2Auth, apiv2.departments.update)
-  router.delete('/api/v2/departments/:id', apiv2Auth, apiv2.departments.delete)
+  router.get('/api/v2/departments', apiv2Auth, canUser('departments:view'), apiv2.departments.get)
+  router.post('/api/v2/departments', apiv2Auth, canUser('departments:create'), apiv2.departments.create)
+  router.put('/api/v2/departments/:id', apiv2Auth, canUser('departments:update'), apiv2.departments.update)
+  router.delete('/api/v2/departments/:id', apiv2Auth, canUser('departments:delete'), apiv2.departments.delete)
 
   // Notices
   router.get('/api/v2/notices', apiv2Auth, apiv2.notices.get)
   router.put('/api/v2/notices/:id', apiv2Auth, canUser('notices:update'), apiv2.notices.update)
   router.put('/api/v2/notices/:id/activate', apiv2Auth, canUser('notices:activate'), apiv2.notices.activate)

Vulnerable code:  *  Updated:    2/14/19 12:07 AM
  router.get('/api/v2/accounts', apiv2Auth, apiv2.accounts.get)
  router.post('/api/v2/accounts', apiv2Auth, apiv2.accounts.create)
  router.put('/api/v2/accounts/:username', apiv2Auth, apiv2.accounts.update)
  router.get('/api/v2/tickets', apiv2Auth, apiv2.tickets.get)
  router.post('/api/v2/tickets', apiv2Auth, apiv2.tickets.create)
  router.get('/api/v2/tickets/:uid', apiv2Auth, apiv2.tickets.single)
  router.put('/api/v2/tickets/batch', apiv2Auth, apiv2.tickets.batchUpdate)
  router.put('/api/v2/tickets/:uid', apiv2Auth, apiv2.tickets.update)
  router.delete('/api/v2/tickets/:uid', apiv2Auth, apiv2.tickets.delete)
  router.post('/api/v2/groups', apiv2Auth, apiv2.groups.create)
  router.put('/api/v2/groups/:id', apiv2Auth, apiv2.groups.update)
  router.delete('/api/v2/groups/:id', apiv2Auth, apiv2.groups.delete)
  router.get('/api/v2/teams', apiv2Auth, apiv2.teams.get)
  router.post('/api/v2/teams', apiv2Auth, apiv2.teams.create)
  router.put('/api/v2/teams/:id', apiv2Auth, apiv2.teams.update)
  router.delete('/api/v2/teams/:id', apiv2Auth, apiv2.teams.delete)
  router.get('/api/v2/departments', apiv2Auth, apiv2.departments.get)
  router.post('/api/v2/departments', apiv2Auth, apiv2.departments.create)
  router.put('/api/v2/departments/:id', apiv2Auth, apiv2.departments.update)
  router.delete('/api/v2/departments/:id', apiv2Auth, apiv2.departments.delete)
Fixed code:  *  Updated:    5/17/22 2:15 PM
  router.get('/api/v2/accounts', apiv2Auth, canUser('accounts:view'), apiv2.accounts.get)
  router.post('/api/v2/accounts', apiv2Auth, canUser('accounts:create'), apiv2.accounts.create)
  router.put('/api/v2/accounts/:username', canUser('accounts:update'), apiv2Auth, apiv2.accounts.update)
  router.get('/api/v2/tickets', apiv2Auth, canUser('tickets:view'), apiv2.tickets.get)
  router.post('/api/v2/tickets', apiv2Auth, canUser('tickets:create'), apiv2.tickets.create)
  router.get('/api/v2/tickets/:uid', apiv2Auth, canUser('tickets:view'), apiv2.tickets.single)
  router.put('/api/v2/tickets/batch', apiv2Auth, canUser('tickets:update'), apiv2.tickets.batchUpdate)
  router.put('/api/v2/tickets/:uid', apiv2Auth, canUser('tickets:update'), apiv2.tickets.update)
  router.delete('/api/v2/tickets/:uid', apiv2Auth, canUser('tickets:delete'), apiv2.tickets.delete)
  router.post('/api/v2/groups', apiv2Auth, canUser('groups:create'), apiv2.groups.create)
  router.put('/api/v2/groups/:id', apiv2Auth, canUser('groups:update'), apiv2.groups.update)
  router.delete('/api/v2/groups/:id', apiv2Auth, canUser('groups:delete'), apiv2.groups.delete)
  router.get('/api/v2/teams', apiv2Auth, canUser('teams:view'), apiv2.teams.get)
  router.post('/api/v2/teams', apiv2Auth, canUser('teams:create'), apiv2.teams.create)
  router.put('/api/v2/teams/:id', apiv2Auth, canUser('teams:update'), apiv2.teams.update)
  router.delete('/api/v2/teams/:id', apiv2Auth, canUser('teams:delete'), apiv2.teams.delete)
  router.get('/api/v2/departments', apiv2Auth, canUser('departments:view'), apiv2.departments.get)
  router.post('/api/v2/departments', apiv2Auth, canUser('departments:create'), apiv2.departments.create)
  router.put('/api/v2/departments/:id', apiv2Auth, canUser('departments:update'), apiv2.departments.update)
  router.delete('/api/v2/departments/:id', apiv2Auth, canUser('departments:delete'), apiv2.departments.delete)