CVE-2023-33956: Authorization Bypass Through User-Controlled Key (CWE-639)
value: Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any other user, regardless of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is image uploaded under **/files** directory regard less of uploaded by any user. This vulnerability poses a significant impact and severity to the application's security. By manipulating the URL parameter, an attacker can access sensitive files that should only be available to authorized users. This includes confidential documents or any other type of file stored within the application. The ability to read these files can lead to various detrimental consequences, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure of trade secrets. Additionally, it could result in legal and regulatory implications, reputation damage, financial losses, and potential compromise of user trust. Users are advised to upgrade. There are no known workarounds for this vulnerability.


CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 6.5
Published: 2023-06-05T20:15Z
Repository: https://github.com/kanboard/kanboard
Language: PHP
Files changed: app/Controller/BaseController.php
Commit date: 2023-06-02 20:29:24 -0700
Commit message: Fix Parameter based Indirect Object Referencing leading to private file exposure

Diff: diff --git a/app/Controller/BaseController.php b/app/Controller/BaseController.php
index ca4ca081a8..5aab7e4c1b 100644
--- a/app/Controller/BaseController.php
+++ b/app/Controller/BaseController.php
@@ -87,14 +87,14 @@ abstract class BaseController extends Base
      * Get Task or Project file
      *
      * @access protected
      * @return array
      * @throws PageNotFoundException
-     * @throws AccessForbiddenException
      */
     protected function getFile()
     {
+        $project_id = $this->request->getIntegerParam('project_id');
         $task_id = $this->request->getIntegerParam('task_id');
         $file_id = $this->request->getIntegerParam('file_id');
         $model = 'projectFileModel';
 
         if ($task_id > 0) {
@@ -106,11 +106,15 @@ abstract class BaseController extends Base
         if (empty($file)) {
             throw new PageNotFoundException();
         }
 
         if (isset($file['task_id']) && $file['task_id'] != $task_id) {
-            throw new AccessForbiddenException();
+            throw new PageNotFoundException();
+        }
+
+        if (isset($file['project_id']) && $file['project_id'] != $project_id) {
+            throw new PageNotFoundException();
         }
 
         $file['model'] = $model;
         return $file;
     }

Vulnerable code:      * @throws AccessForbiddenException
            throw new AccessForbiddenException();
Fixed code:         $project_id = $this->request->getIntegerParam('project_id');
            throw new PageNotFoundException();
        }

        if (isset($file['project_id']) && $file['project_id'] != $project_id) {
            throw new PageNotFoundException();