CVE-2022-25318 (PHP, published 2022-02-18T06:15Z)
Description: value: An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing groups.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/cerebrate-project/cerebrate
Files changed:
src/Controller/Component/CRUDComponent.php
src/Controller/SharingGroupsController.php
Commit message: fix: [security] Sharing group ACL fixes

- added indirect object reference protection
- added correct ACL functionalities to delete, addOrg, removeOrg

- as reported by Dawid Czarnecki from Zigrin Security


Vulnerable code:
            'contain' => ['SharingGroupOrgs', 'Organisations', 'Users' => ['fields' => ['id', 'username']]]
        $this->CRUD->delete($id);

Fixed code:
        if (empty($data)) {
            throw new NotFoundException(__('Invalid {0}.', $this->ObjectAlias));
        }
        if (empty($data)) {
            throw new NotFoundException(__('Invalid {0}.', $this->ObjectAlias));
        }
use Cake\Http\Exception\NotFoundException;
        $currentUser = $this->ACL->getUser();
            'contain' => ['SharingGroupOrgs', 'Organisations', 'Users' => ['fields' => ['id', 'username']]],
            'afterFind' => function($data) use ($currentUser) {
                if (empty($currentUser['role']['perm_admin'])) {
                    $orgFround = false;
                    if (!empty($data['sharing_group_orgs'])) {
                        foreach ($data['sharing_group_orgs'] as $org) {
                            if ($org['id'] === $currentUser['organisation_id']) {
                                $orgFound = true;
                            }
                        }
                    }
                    if ($data['organisation_id'] !== $currentUser['organisation_id'] && !$orgFround) {
                        return null;
                    }
                }
                return $data;
            }
        $currentUser = $this->ACL->getUser();
        if (empty($currentUser['role']['perm_admin'])) {
            $params['conditions'] = ['organisation_id' => $currentUser['organisation_id']];
        }
        $this->CRUD->delete($id, $params);
        $currentUser = $this->ACL->getUser();
        if (empty($currentUser['role']['perm_admin'])) {
            if ($sharingGroup['organisation_id'] !== $currentUser['organisation_id']) {
                $sharingGroup = null;
            }
        }
        if (empty($sharingGroup)) {
            throw new NotFoundException(__('Invalid SharingGroup.'));
        }
        $currentUser = $this->ACL->getUser();
        if (empty($currentUser['role']['perm_admin'])) {
            if ($sharingGroup['organisation_id'] !== $currentUser['organisation_id']) {
                $sharingGroup = null;
            }
        }
        if (empty($sharingGroup)) {
            throw new NotFoundException(__('Invalid SharingGroup.'));
        }