CVE-2022-1808: Other (NVD-CWE-Other)
value: Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 8.8
Published: 2022-05-31T22:15Z
Repository: https://github.com/polonel/trudesk
Language: JavaScript
Files changed: src/controllers/api/v1/tickets.js
Commit date: 2022-05-28 04:25:26 -0400
Commit message: fix(core): verify user exists
Diff: diff --git a/src/controllers/api/v1/tickets.js b/src/controllers/api/v1/tickets.js
index c58b88477..0d57026e2 100644
--- a/src/controllers/api/v1/tickets.js
+++ b/src/controllers/api/v1/tickets.js
@@ -13,11 +13,11 @@
  */
 
 var async = require('async')
 var _ = require('lodash')
 var moment = require('moment-timezone')
-var winston = require('winston')
+var winston = require('../../../logger')
 var permissions = require('../../../permissions')
 var emitter = require('../../../emitter')
 var xss = require('xss')
 var sanitizeHtml = require('sanitize-html')
 
@@ -1826,16 +1826,27 @@ apiTickets.subscribe = function (req, res) {
   var ticketId = req.params.id
   var data = req.body
   if (_.isUndefined(data.user) || _.isUndefined(data.subscribe))
     return res.status(400).json({ error: 'Invalid Post Data.' })
 
+  if (data.user.toString() !== req.user._id.toString()) return res.status(401).json({ error: 'Unauthorized!' })
+
   var ticketModel = require('../../../models/ticket')
   ticketModel.getTicketById(ticketId, function (err, ticket) {
     if (err) return res.status(400).json({ error: 'Invalid Ticket Id' })
 
     async.series(
       [
+        function (callback) {
+          require('../../../models/user').find({ _id: data.user }, function (err, user) {
+            if (err) return callback(err)
+
+            if (!user) return callback(new Error('Unauthorized!'))
+
+            return callback()
+          })
+        },
         function (callback) {
           if (data.subscribe) {
             ticket.addSubscriber(data.user, function () {
               callback()
             })
@@ -1844,11 +1855,16 @@ apiTickets.subscribe = function (req, res) {
               callback()
             })
           }
         }
       ],
-      function () {
+      function (err) {
+        if (err) {
+          winston.warn(err)
+          return res.status(401).json({ error: 'Unauthorized!' })
+        }
+
         ticket.save(function (err, ticket) {
           if (err) return res.status(400).json({ error: err })
 
           emitter.emit('ticket:subscriber:update', ticket)
 

Vulnerable code: var winston = require('winston')
      function () {
Fixed code: var winston = require('../../../logger')
  if (data.user.toString() !== req.user._id.toString()) return res.status(401).json({ error: 'Unauthorized!' })

        function (callback) {
          require('../../../models/user').find({ _id: data.user }, function (err, user) {
            if (err) return callback(err)

            if (!user) return callback(new Error('Unauthorized!'))

            return callback()
          })
        },
      function (err) {
        if (err) {
          winston.warn(err)
          return res.status(401).json({ error: 'Unauthorized!' })
        }