CVE-2020-15248: Improper Privilege Management (CWE-269)
value: October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. Issue has been patched in Build 470 (v1.0.470) & v1.1.1.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 4.2
Published: 2020-11-23T20:15Z
Repository: https://github.com/octobercms/october
Language: PHP
Files changed: modules/backend/ServiceProvider.php, modules/system/ServiceProvider.php
Commit date: 2020-09-11 02:12:28 -0600
Commit message: Tightened up the default permissions granted to the "Publisher" system role out of the box

(cherry picked from commit 8a785e439395aa901d2b9d7bcb6a343a071c7870)

Diff: diff --git a/modules/backend/ServiceProvider.php b/modules/backend/ServiceProvider.php
index b0a5026f8..7452c4247 100644
--- a/modules/backend/ServiceProvider.php
+++ b/modules/backend/ServiceProvider.php
@@ -138,35 +138,38 @@ class ServiceProvider extends ModuleServiceProvider
     {
         BackendAuth::registerCallback(function ($manager) {
             $manager->registerPermissions('October.Backend', [
                 'backend.access_dashboard' => [
                     'label' => 'system::lang.permissions.view_the_dashboard',
-                    'tab'   => 'system::lang.permissions.name'
+                    'tab'   => 'system::lang.permissions.name',
                 ],
                 'backend.manage_default_dashboard' => [
                     'label' => 'system::lang.permissions.manage_default_dashboard',
                     'tab'   => 'system::lang.permissions.name',
+                    'roles' => UserRole::CODE_DEVELOPER,
                 ],
                 'backend.manage_users' => [
                     'label' => 'system::lang.permissions.manage_other_administrators',
-                    'tab'   => 'system::lang.permissions.name'
+                    'tab'   => 'system::lang.permissions.name',
+                    'roles' => UserRole::CODE_DEVELOPER,
                 ],
                 'backend.impersonate_users' => [
                     'label' => 'system::lang.permissions.impersonate_users',
                     'tab'   => 'system::lang.permissions.name',
+                    'roles' => UserRole::CODE_DEVELOPER,
                 ],
                 'backend.manage_preferences' => [
                     'label' => 'system::lang.permissions.manage_preferences',
-                    'tab'   => 'system::lang.permissions.name'
+                    'tab'   => 'system::lang.permissions.name',
                 ],
                 'backend.manage_editor' => [
                     'label' => 'system::lang.permissions.manage_editor',
-                    'tab'   => 'system::lang.permissions.name'
+                    'tab'   => 'system::lang.permissions.name',
                 ],
                 'backend.manage_branding' => [
                     'label' => 'system::lang.permissions.manage_branding',
-                    'tab'   => 'system::lang.permissions.name'
+                    'tab'   => 'system::lang.permissions.name',
                 ],
                 'media.manage_media' => [
                     'label' => 'backend::lang.permissions.manage_media',
                     'tab' => 'system::lang.permissions.name',
                 ],
diff --git a/modules/system/ServiceProvider.php b/modules/system/ServiceProvider.php
index ae065786a..284dbb94b 100644
--- a/modules/system/ServiceProvider.php
+++ b/modules/system/ServiceProvider.php
@@ -7,10 +7,11 @@ use Event;
 use Config;
 use Backend;
 use Request;
 use BackendMenu;
 use BackendAuth;
+use Backend\Models\UserRole;
 use Twig\Extension\SandboxExtension;
 use Twig\Environment as TwigEnvironment;
 use System\Classes\MailManager;
 use System\Classes\ErrorHandler;
 use System\Classes\MarkupManager;
@@ -415,23 +416,27 @@ class ServiceProvider extends ModuleServiceProvider
     {
         BackendAuth::registerCallback(function ($manager) {
             $manager->registerPermissions('October.System', [
                 'system.manage_updates' => [
                     'label' => 'system::lang.permissions.manage_software_updates',
-                    'tab' => 'system::lang.permissions.name'
+                    'tab' => 'system::lang.permissions.name',
+                    'roles' => UserRole::CODE_DEVELOPER,
                 ],
                 'system.access_logs' => [
                     'label' => 'system::lang.permissions.access_logs',
-                    'tab' => 'system::lang.permissions.name'
+                    'tab' => 'system::lang.permissions.name',
+                    'roles' => UserRole::CODE_DEVELOPER,
                 ],
                 'system.manage_mail_settings' => [
                     'label' => 'system::lang.permissions.manage_mail_settings',
-                    'tab' => 'system::lang.permissions.name'
+                    'tab' => 'system::lang.permissions.name',
+                    'roles' => UserRole::CODE_DEVELOPER,
                 ],
                 'system.manage_mail_templates' => [
                     'label' => 'system::lang.permissions.manage_mail_templates',
-                    'tab' => 'system::lang.permissions.name'
+                    'tab' => 'system::lang.permissions.name',
+                    'roles' => UserRole::CODE_DEVELOPER,
                 ]
             ]);
         });
     }
 

Vulnerable code:                     'tab'   => 'system::lang.permissions.name'
                    'tab'   => 'system::lang.permissions.name'
                    'tab'   => 'system::lang.permissions.name'
                    'tab'   => 'system::lang.permissions.name'
                    'tab'   => 'system::lang.permissions.name'
                    'tab' => 'system::lang.permissions.name'
                    'tab' => 'system::lang.permissions.name'
                    'tab' => 'system::lang.permissions.name'
                    'tab' => 'system::lang.permissions.name'
Fixed code:                     'tab'   => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab'   => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab'   => 'system::lang.permissions.name',
                    'tab'   => 'system::lang.permissions.name',
                    'tab'   => 'system::lang.permissions.name',
use Backend\Models\UserRole;
                    'tab' => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab' => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab' => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,
                    'tab' => 'system::lang.permissions.name',
                    'roles' => UserRole::CODE_DEVELOPER,