CVE-2018-20851 (Ruby, published 2019-07-10T14:15Z)
Description: value: Helpy before 2.2.0 allows agents to edit admins.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/helpyio/helpy
Files changed:
app/models/user.rb
app/views/admin/topics/_topic_options.html.erb
app/views/admin/users/_user.html.erb
app/views/admin/users/_user_context_menu.html.erb
app/views/admin/users/_user_info_with_tickets.html.erb
app/views/layouts/_admin_header.html.erb
Commit message: Prevent agents from editing admins, other permission hardening


Vulnerable code:
      <li><%= link_to t(:edit_user, default: 'Edit User'), edit_admin_user_path(@topic.user), remote: false %></li>
        <li><%= link_to t(:edit_user, default: 'Edit User'), edit_admin_user_path(user, mode: 'edit'), remote: false %></li>
    <li><%= link_to t(:edit_user, default: 'Edit User'), edit_admin_user_path(user), remote: false %></li>
          <%= best_in_place user, :name, as: :input, url: admin_user_path(user) %>
            <%= best_in_place user, :account_number, as: :input, url: admin_user_path(user),
          <%= best_in_place user, :company, as: :input, url: admin_user_path(user),
          <%= best_in_place user, :email, as: :input, url: admin_user_path(user) %><br/>
        <%= best_in_place user, :street, as: :input, url: admin_user_path(user),
        <%= best_in_place user, :city, as: :input, url: admin_user_path(user),
        <%= best_in_place user, :state, as: :input, url: admin_user_path(user),
        <%= best_in_place user, :zip, as: :input, url: admin_user_path(user),
        <%= t(:work_phone, default: "work") %>: <%= best_in_place user, :work_phone,
        <%= t(:home_home, default: "home") %>: <%= best_in_place user, :home_phone,
        <%= t(:cell_phone, default: "cell") %>: <%= best_in_place user, :cell_phone,
        <%= best_in_place user, :notes, as: :textarea, url: admin_user_path(user),
                <%= upper_nav_item(t(:users, default: 'Customers'), admin_users_path(role: 'user'), ["users"], ["index","show","edit","update"], "fas fa-users") if current_user.is_admin? %>

Fixed code:
  # Is this user editable by the current logged in agent?
  def can_be_edited? current_user
    return true if current_user.is_admin?
    !self.is_agent?
  end

      <li><%= link_to t(:edit_user, default: 'Edit User'), edit_admin_user_path(@topic.user), remote: false if @topic.user.can_be_edited? current_user %></li>
        <li><%= link_to t(:edit_user, default: 'Edit User'), edit_admin_user_path(user, mode: 'edit'), remote: false if user.can_be_edited? current_user%></li>
    <li><%= link_to t(:edit_user, default: 'Edit User'), edit_admin_user_path(user), remote: false if user.can_be_edited? current_user %></li>
          <%= best_in_place_if !user.is_agent?, user, :name, as: :input, url: admin_user_path(user) %>
            <%= best_in_place_if !user.is_agent?, user, :account_number, as: :input, url: admin_user_path(user),
          <%= best_in_place_if !user.is_agent?, user, :company, as: :input, url: admin_user_path(user),
          <%= best_in_place_if !user.is_agent?, user, :email, as: :input, url: admin_user_path(user) %><br/>
        <%= best_in_place_if !user.is_agent?, user, :street, as: :input, url: admin_user_path(user),
        <%= best_in_place_if !user.is_agent?, user, :city, as: :input, url: admin_user_path(user),
        <%= best_in_place_if !user.is_agent?, user, :state, as: :input, url: admin_user_path(user),
        <%= best_in_place_if !user.is_agent?, user, :zip, as: :input, url: admin_user_path(user),
        <%= t(:work_phone, default: "work") %>: <%= best_in_place_if !user.is_agent?, user, :work_phone,
        <%= t(:home_home, default: "home") %>: <%= best_in_place_if !user.is_agent?, user, :home_phone,
        <%= t(:cell_phone, default: "cell") %>: <%= best_in_place_if !user.is_agent?, user, :cell_phone,
        <%= best_in_place_if !user.is_agent?, user, :notes, as: :textarea, url: admin_user_path(user),
                <%= upper_nav_item(t(:users, default: 'Customers'), admin_users_path(role: 'user'), ["users"], ["index","show","edit","update"], "fas fa-users") if current_user.is_agent? %>