Vulnerability: The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET request.
Vulnerability ID: CVE-2012-3472
CWE: CWE-287
Severity score: 4.9
Project: https://github.com/ushahidi/Ushahidi_Web
Published: 2012-08-12
File: application/libraries/api/MY_Email_Api_Object.php
Commit message: Add authentication to the email API #665

* Also fixes undefined variable $ret_value error
Commit author: Robbie Mackay

Vulnerable version (before fix):
 <?php defined('SYSPATH') or die('No direct script access.'); /**  * This class handles GET request for KML via the API.  *  * @version 25 - Emmanuel Kala 2010-10-27  * public function __construct($api_service)      */     public function perform_task()     {         $this->_list_all_email_msgs();     }  public function perform_task()      */     public function email_action()     {         if ( ! $this->api_service->verify_array_index($this->request, 'action'))         {             $this->set_error_message(array( public function _delete_email_msg()                     //email id doesn't exist in DB                     //TODO i18nize the string                     $this->error_messages .= "Email ID does not exist.";                     $this->ret_value = 1;                  }             }

Fixed version (after fix):
 <?php defined('SYSPATH') or die('No direct script access.'); /**  * This class handles GET request for Email via the API.  *  * @version 25 - Emmanuel Kala 2010-10-27  * public function __construct($api_service)      */     public function perform_task()     { 			// Authenticate the user 			if ( ! $this->api_service->_login(TRUE)) 			{ 				$this->set_error_message($this->response(2)); 				return; 			} 			         $this->_list_all_email_msgs();     }  public function perform_task()      */     public function email_action()     { 			// Authenticate the user 			if ( ! $this->api_service->_login(TRUE)) 			{ 				$this->set_error_message($this->response(2)); 				return; 			} 			         if ( ! $this->api_service->verify_array_index($this->request, 'action'))         {             $this->set_error_message(array( public function _delete_email_msg()                     //email id doesn't exist in DB                     //TODO i18nize the string                     $this->error_messages .= "Email ID does not exist.";                     $ret_value = 1;                  }             }

Patch:
patch: @@ -1,6 +1,6 @@
 <?php defined('SYSPATH') or die('No direct script access.');
 /**
- * This class handles GET request for KML via the API.
+ * This class handles GET request for Email via the API.
  *
  * @version 25 - Emmanuel Kala 2010-10-27
  *
@@ -26,6 +26,13 @@ public function __construct($api_service)
      */
     public function perform_task()
     {
+			// Authenticate the user
+			if ( ! $this->api_service->_login(TRUE))
+			{
+				$this->set_error_message($this->response(2));
+				return;
+			}
+			
         $this->_list_all_email_msgs();
     }
 
@@ -34,6 +41,13 @@ public function perform_task()
      */
     public function email_action()
     {
+			// Authenticate the user
+			if ( ! $this->api_service->_login(TRUE))
+			{
+				$this->set_error_message($this->response(2));
+				return;
+			}
+			
         if ( ! $this->api_service->verify_array_index($this->request, 'action'))
         {
             $this->set_error_message(array(
@@ -159,7 +173,7 @@ public function _delete_email_msg()
                     //email id doesn't exist in DB
                     //TODO i18nize the string
                     $this->error_messages .= "Email ID does not exist.";
-                    $this->ret_value = 1;
+                    $ret_value = 1;
 
                 }
             }
path: application/libraries/api/MY_Email_Api_Object.php