CVE-2022-0580 (PHP, published 2022-02-14T23:15Z)
Description: value: Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.


Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/alert-transports.inc.php
routes/web.php
Commit message: Moved some pages to be within admin route (#13782)

* Moved plugin admin pages to be within admin route
* Wrap html transports page in admin check
* Moved Port group controller to be admin protected
* fixed tests

Vulnerable code:
// handle OAuth requests
$request = request();  // grab the Request object
if ($request->has('oauthtransport')) {
    // make sure transport is safe
    $validator = Validator::make($request->all(), ['oauthtransport' => 'required|alpha']);
    if ($validator->passes()) {
        $transport_name = $request->get('oauthtransport');
        $class = \LibreNMS\Alert\Transport::getClass($transport_name);
        if (class_exists($class)) {
            $transport = app($class);
            if ($transport->handleOauth($request)) {
                flash()->addSuccess("$transport_name added successfully.");
            } else {
                flash()->addError("$transport_name was not added. Check the log for details.");
    // remove get variables otherwise things will get double added
    echo '<script>window.history.replaceState(null, null, window.location.pathname);</script>';
unset($request);

// print alert transports
require_once 'includes/html/print-alert-transports.php';
    Route::resource('port-groups', 'PortGroupController');
    Route::get('plugin/settings', 'PluginAdminController')->name('plugin.admin');
    Route::get('plugin/settings/{plugin:plugin_name}', 'PluginSettingsController')->name('plugin.settings');
    Route::post('plugin/settings/{plugin:plugin_name}', 'PluginSettingsController@update')->name('plugin.update');

Fixed code:
if (Auth::user()->hasGlobalAdmin()) {
    // handle OAuth requests
    $request = request();  // grab the Request object
    if ($request->has('oauthtransport')) {
        // make sure transport is safe
        $validator = Validator::make($request->all(), ['oauthtransport' => 'required|alpha']);
        if ($validator->passes()) {
            $transport_name = $request->get('oauthtransport');
            $class = \LibreNMS\Alert\Transport::getClass($transport_name);
            if (class_exists($class)) {
                $transport = app($class);
                if ($transport->handleOauth($request)) {
                    flash()->addSuccess("$transport_name added successfully.");
                } else {
                    flash()->addError("$transport_name was not added. Check the log for details.");
                }

        // remove get variables otherwise things will get double added
        echo '<script>window.history.replaceState(null, null, window.location.pathname);</script>';
    unset($request);
    // print alert transports
    require_once 'includes/html/print-alert-transports.php';
} else {
    include 'includes/html/error-no-perm.inc.php';

        Route::get('plugin/settings', 'PluginAdminController')->name('plugin.admin');
        Route::get('plugin/settings/{plugin:plugin_name}', 'PluginSettingsController')->name('plugin.settings');
        Route::post('plugin/settings/{plugin:plugin_name}', 'PluginSettingsController@update')->name('plugin.update');

        Route::resource('port-groups', 'PortGroupController');