CVE-2024-34695: Insufficient Information (NVD-CWE-noinfo)
value: WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:39Z
Repository: https://github.com/SakuraIsayeki/WOWS-Karma
Language: C#
Files changed: WowsKarma.Api/Controllers/PostController.cs, WowsKarma.Api/Startup.cs
Commit date: 2024-05-10 17:20:39 +0200
Commit message: feat(api): Add UserAtomicLock middleware to request pipeline

- Added `UserAtomicLock` attribute to the `CreatePost` action in `PostController.cs`
- Registered `UserAtomicLockMiddleware` as a singleton in `Startup.cs`
- Added `app.UseMiddleware<UserAtomicLockMiddleware>()` in the HTTP request pipeline

Diff: diff --git a/WowsKarma.Api/Controllers/PostController.cs b/WowsKarma.Api/Controllers/PostController.cs
index a2e601f..6132962 100644
--- a/WowsKarma.Api/Controllers/PostController.cs
+++ b/WowsKarma.Api/Controllers/PostController.cs
@@ -194,11 +194,11 @@ public sealed class PostController : ControllerBase
 	/// <response code="201">Post was successfuly created.</response>
 	/// <response code="400">Post contents validation has failed.</response>
 	/// <response code="422">Attached replay is invalid.</response>
 	/// <response code="403">Restrictions are in effect for one of the targeted accounts.</response>
 	/// <response code="404">One of the targeted accounts was not found.</response>
-	[HttpPost, Authorize(RequireNoPlatformBans)]
+	[HttpPost, Authorize(RequireNoPlatformBans), UserAtomicLock]
 	[ProducesResponseType(201), ProducesResponseType(400), ProducesResponseType(422), ProducesResponseType(typeof(string), 403), ProducesResponseType(typeof(string), 404)]
 	public async Task<IActionResult> CreatePost(
 		[FromForm] string postDto, 
 		[FromServices] ReplaysIngestService replaysIngestService,
 		IFormFile? replay = null, 
diff --git a/WowsKarma.Api/Startup.cs b/WowsKarma.Api/Startup.cs
index 9046b89..d240c8f 100644
--- a/WowsKarma.Api/Startup.cs
+++ b/WowsKarma.Api/Startup.cs
@@ -8,11 +8,11 @@ using Microsoft.IdentityModel.Tokens;
 using Microsoft.OpenApi.Models;
 using Nodsoft.WowsReplaysUnpack;
 using System.IdentityModel.Tokens.Jwt;
 using System.Net;
 using System.Reflection;
-using System.Text;
+using System.Text; 
 using Hangfire;
 using Hangfire.PostgreSql;
 using Hangfire.Tags.PostgreSql;
 using Microsoft.AspNetCore.Authorization;
 using Newtonsoft.Json;
@@ -278,10 +278,12 @@ public sealed class Startup
 		});
 
 		services.AddResiliencePolicies();
 
 		services.AddSystemd();
+
+		services.AddSingleton<UserAtomicLockMiddleware>();
 	}
 
 	// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
 	public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
 	{
@@ -332,11 +334,12 @@ public sealed class Startup
 
 		app.UseAuthentication();
 		app.UseAuthorization();
 
 		app.UseMiddleware<RequestLoggingMiddleware>();
-
+		app.UseMiddleware<UserAtomicLockMiddleware>();
+		
 		app.UseEndpoints(endpoints =>
 		{
 			endpoints.MapDefaultControllerRoute();
 				
 			endpoints.MapHangfireDashboard("/hangfire", new()

Vulnerable code: 	[HttpPost, Authorize(RequireNoPlatformBans)]
using System.Text;

Fixed code: 	[HttpPost, Authorize(RequireNoPlatformBans), UserAtomicLock]
using System.Text; 

		services.AddSingleton<UserAtomicLockMiddleware>();
		app.UseMiddleware<UserAtomicLockMiddleware>();