CVE-2022-24865 (published 2022-04-20T20:15Z)

HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/humhub/humhub
commit_details: repo_url: https://github.com/humhub/humhub
author: Yuriy Bakhtin
author_date: 2022-04-19 18:57:30+03:00
msg: Fix must change password (#5638)

* Fix must change password

* Update CHANGELOG.md (#5638)

* Improve access validation

* Update CHANGELOG.md

Co-authored-by: Lucas Bartholemy <luke-@users.noreply.github.com>
repository: repo_url: https://github.com/humhub/humhub
repo_name: humhub/humhub
description: HumHub is an Open Source Enterprise Social Network. Easy to install, intuitive to use and extendable with countless freely available modules.
repo_language: PHP
owner: humhub
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,7 @@ HumHub Changelog
 - Fix #5517: Don't send "Follows" notification on request friendship
 - Fix #5563: Limit backup duration of RichText editor for 2 hours
 - Enh #5601: Backup RichText in sessionStorage
+- Fix #5638: Removed return values from `codeCallback`
 - Fix #5634: Fix tests NonceCest
 - Fix #5644: Fix console command space/assign-all-members
 

programming_language: Markdown
filename: AccessControl.php
change_type: ModificationType.MODIFY
diff: @@ -11,9 +11,7 @@ namespace humhub\components\behaviors;
 use humhub\components\access\ControllerAccess;
 use Yii;
 use yii\base\ActionFilter;
-use yii\helpers\Url;
 use yii\web\HttpException;
-use yii\web\Response;
 
 /**
  * Handles the AccessControl for a Controller.
@@ -151,12 +149,13 @@ class AccessControl extends ActionFilter
                 method_exists($this, $this->controllerAccess->codeCallback)) {
                 // Call a specific function for current action filter,
                 // may be used to filter a logged in user for some restriction e.g. "must change password"
-                return call_user_func([$this, $this->controllerAccess->codeCallback]);
+                call_user_func([$this, $this->controllerAccess->codeCallback]);
             } else if ($this->controllerAccess->code == 401) {
-                return $this->loginRequired();
+                $this->loginRequired();
             } else {
                 $this->forbidden();
             }
+            return false;
         }
 
         return parent::beforeAction($action);
@@ -217,31 +216,27 @@ class AccessControl extends ActionFilter
     }
 
     /**
-     * @return bool forces user login
+     * Force user to log in
      */
     protected function loginRequired()
     {
         Yii::$app->user->logout();
         Yii::$app->user->loginRequired();
-
-        return false;
     }
 
     /**
-     * @return Response Redirect user to force to change password
+     * Force user to redirect to change password
      * @since 1.8
      */
     protected function forceChangePassword()
     {
         if (!Yii::$app->user->isMustChangePasswordUrl()) {
-            return Yii::$app->getResponse()->redirect(Url::toRoute(Yii::$app->user->mustChangePasswordRoute));
+            Yii::$app->getResponse()->redirect([Yii::$app->user->mustChangePasswordRoute]);
         }
     }
 
     /**
      * Log out all non admin users when maintenance mode is active
-     *
-     * @return Response Redirect to home page
      * @since 1.8
      */
     protected function checkMaintenanceMode()
@@ -251,7 +246,7 @@ class AccessControl extends ActionFilter
                 Yii::$app->user->logout();
                 Yii::$app->getView()->warn(Yii::t('error', 'Maintenance mode activated: You have been automatically logged out and will no longer have access the platform until the maintenance has been completed.'));
             }
-            return Yii::$app->getResponse()->redirect(['/user/auth/login']);
+            Yii::$app->getResponse()->redirect(['/user/auth/login']);
         }
     }
 }

programming_language: PHP