CVE-2023-3574: Other (NVD-CWE-Other)
value: Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.5
Published: 2023-07-10T16:15Z
Repository: https://github.com/pimcore/customer-data-framework
Language: PHP
Files changed: src/Controller/Admin/RulesController.php, src/Targeting/SegmentTracker.php
Commit date: 2023-07-04 15:24:07 +0200
Commit message: [Bug]: Add missing permission check on Rules controller (#483)

* chore: fix rules permission check

* Apply php-cs-fixer changes

* chore: fix wrong class

* Update RulesController.php

* fix stan

---------

Co-authored-by: kingjia90 <kingjia90@users.noreply.github.com>
Diff: diff --git a/src/Controller/Admin/RulesController.php b/src/Controller/Admin/RulesController.php
index 652a9a40..31f94a55 100644
--- a/src/Controller/Admin/RulesController.php
+++ b/src/Controller/Admin/RulesController.php
@@ -13,18 +13,26 @@
  *  @license    http://www.pimcore.org/license     GPLv3 and PCL
  */
 
 namespace CustomerManagementFrameworkBundle\Controller\Admin;
 
+use Pimcore\Bundle\AdminBundle\Controller\AdminController;
+use Pimcore\Controller\KernelControllerEventInterface;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\Routing\Annotation\Route;
 
 /**
  * @Route("/rules")
  */
-class RulesController extends \Pimcore\Bundle\AdminBundle\Controller\AdminController
+class RulesController extends AdminController implements KernelControllerEventInterface
 {
+    public function onKernelControllerEvent(ControllerEvent $event)
+    {
+        $this->checkPermission('plugin_cmf_perm_customer_automation_rules');
+    }
+
     /**
      * get saved action trigger rules
      *
      * @param Request $request
      * @Route("/list")
diff --git a/src/Targeting/SegmentTracker.php b/src/Targeting/SegmentTracker.php
index 9f81ee8b..9ee64f0b 100644
--- a/src/Targeting/SegmentTracker.php
+++ b/src/Targeting/SegmentTracker.php
@@ -173,21 +173,19 @@ class SegmentTracker
             return [];
         }
 
         //order segments by count, pick $limitSegmentCountPerGroup top segments
         foreach ($segmentCollection as $group => $groupCollection) {
-            if (!empty($groupCollection)) {
-                usort($groupCollection, function ($left, $right) {
-                    if ($left['count'] === $right['count']) {
-                        return 0;
-                    }
+            usort($groupCollection, function ($left, $right) {
+                if ($left['count'] === $right['count']) {
+                    return 0;
+                }
 
-                    return ($left['count'] < $right['count']) ? 1 : -1;
-                });
+                return ($left['count'] < $right['count']) ? 1 : -1;
+            });
 
-                $segmentCollection[$group] = array_slice($groupCollection, 0, $limitSegmentCountPerGroup);
-            }
+            $segmentCollection[$group] = array_slice($groupCollection, 0, $limitSegmentCountPerGroup);
         }
 
         return $segmentCollection;
     }
 

Vulnerable code: class RulesController extends \Pimcore\Bundle\AdminBundle\Controller\AdminController
            if (!empty($groupCollection)) {
                usort($groupCollection, function ($left, $right) {
                    if ($left['count'] === $right['count']) {
                        return 0;
                    }
                    return ($left['count'] < $right['count']) ? 1 : -1;
                });
                $segmentCollection[$group] = array_slice($groupCollection, 0, $limitSegmentCountPerGroup);
            }
Fixed code: use Pimcore\Bundle\AdminBundle\Controller\AdminController;
use Pimcore\Controller\KernelControllerEventInterface;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
class RulesController extends AdminController implements KernelControllerEventInterface
    public function onKernelControllerEvent(ControllerEvent $event)
    {
        $this->checkPermission('plugin_cmf_perm_customer_automation_rules');
    }

            usort($groupCollection, function ($left, $right) {
                if ($left['count'] === $right['count']) {
                    return 0;
                }
                return ($left['count'] < $right['count']) ? 1 : -1;
            });
            $segmentCollection[$group] = array_slice($groupCollection, 0, $limitSegmentCountPerGroup);