CVE-2019-1010308 (published 2019-07-15T18:15Z)

Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It contains sensitive information like passwords etc. The component is: log file. The attack vector is: open the file.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-522
cwe_name: Insufficiently Protected Credentials
description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/aquaverde/aquarius-core
commit_details: repo_url: https://github.com/aquaverde/aquarius-core
author: Stephan Balmer
author_date: 2015-09-17 14:51:08+02:00
msg: allow login without password in DEV mode
repository: repo_url: https://github.com/aquaverde/aquarius-core
repo_name: aquaverde/aquarius-core
description: aquarius CMS 
repo_language: PHP
owner: aquaverde
file_changes: filename: backend.php
change_type: ModificationType.MODIFY
diff: @@ -11,9 +11,10 @@ Log::backtrace('backend');
 
 
 /* Process logins & load logged in user */
+    $allpass = $aquarius->conf('admin/allpass');
     require_once "db/Users.php";
-    $login_status = db_Users::authenticate();
-                
+    $login_status = db_Users::authenticate($allpass);
+
     // Redirect to frontend if user wants to
     if ($login_status instanceof db_User && isset($_REQUEST['login_frontend'])) {
         header('Location:'.PROJECT_URL);

programming_language: PHP
filename: config.base.php
change_type: ModificationType.MODIFY
diff: @@ -200,6 +200,16 @@ $config['admin']['allow_languageadmin'] = false;
 $config['admin']['link_target'] = '';
 
 
+/** Omit password checking for backend logins.
+  * This is useful during development, use with care! Do not ever enable this
+  * on a publicly accessible system. Best enable DEV mode to get this, change it
+  * in config.local.php if at all.
+  *
+  * Preset is false.
+  */
+$config['admin']['allpass'] = false;
+
+
 /** Standard email address to use as sender address
   * This is used in the "Sender:" header when the system generates mails. The
   * "From:" header will also be set to this address should it not be set

programming_language: PHP
filename: config.override.php
change_type: ModificationType.MODIFY
diff: @@ -7,7 +7,8 @@
   * in config.local.php.
   */
 if (DEV) {
-    /** Overrides suitable for developement */
+    /** Overrides suitable for development */
+    $config['admin']['allpass'] = true;
     $config['frontend']['domain'] = null;
     $config['frontend']['domains'] = array();
     $config['frontend']['cache']['templates'] = false;

programming_language: PHP
filename: Users.php
change_type: ModificationType.MODIFY
diff: @@ -40,14 +40,21 @@ class db_Users extends DB_DataObject
     /** Verify user credentials and register user in session if successful.
       * Requires fields 'backend_login', 'username' and 'password' to be set in $_REQUEST
       *   backend_login: must be set or this method won't try to authenticate
+      *  @param $allpass optional parameter to skip password check
       *  @return user instance if login is successful, -1 if login failed, false if no login credentials were found.
       */
-    static function authenticate() {
+    static function authenticate($allpass=false) {
         if (isset($_REQUEST['backend_login'])) {
             $user = DB_DataObject::factory('users');
             $user->active = true;
             $user->name = $_REQUEST['username'];
-            $user->find(true);
+            $found = $user->find(true);
+
+            if ($found && $allpass) {
+                Log::debug("Logging in user '$user->name' without checking password");
+                $user->login();
+                return true;
+            }
 
             // Don't look whether that user exists, so we give less timing information
             // Instead, rely only on having a matching password

programming_language: PHP