CVE-2022-1728 (published 2022-05-16T15:15Z)

Allowing long password leads to denial of service in polonel/trudesk in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/polonel/trudesk
commit_details: repo_url: https://github.com/polonel/trudesk
author: Chris Brame
author_date: 2022-05-15 11:51:25-04:00
msg: fix(account): security fix
repository: repo_url: https://github.com/polonel/trudesk
repo_name: polonel/trudesk
description:  :coffee: :seedling: Trudesk is an open-source help desk/ticketing solution.
repo_language: JavaScript
owner: polonel
file_changes: filename: user.js
change_type: ModificationType.MODIFY
diff: @@ -100,6 +100,8 @@ userSchema.pre('save', function (next) {
     return next()
   }
 
+  if (user.password.toString().length > 255) user.password = utils.applyMaxTextLength(user.password)
+
   bcrypt.genSalt(SALT_FACTOR, function (err, salt) {
     if (err) return next(err)
 

programming_language: JavaScript
filename: profile.js
change_type: ModificationType.MODIFY
diff: @@ -45,6 +45,14 @@ define([
         }, 0)
       }
 
+      function validateEmail (email) {
+        return String(email)
+          .toLowerCase()
+          .match(
+            /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/
+          )
+      }
+
       $scope.updateUser = function ($event) {
         $event.preventDefault()
 
@@ -52,6 +60,17 @@ define([
         if (_.isUndefined(id)) return
         var data = getFormData()
 
+        if (
+          data.fullname.toString().length > 25 ||
+          data.password.toString().length > 255 ||
+          data.cPassword.toString().length > 255 ||
+          data.email.toString().length > 255 ||
+          !validateEmail(data.email.toString())
+        ) {
+          helpers.UI.showSnackbar('Form data invalid.', true)
+          return false
+        }
+
         $http
           .put('/api/v1/users/' + data.username, {
             aId: id,

programming_language: JavaScript
filename: profile.hbs
change_type: ModificationType.MODIFY
diff: @@ -92,15 +92,15 @@
                                         </div>
                                         <div class="uk-margin-medium-bottom">
                                             <label for="aPass">Password</label>
-                                            <input id="aPass" class="md-input" name="aPass" type="password" />
+                                            <input id="aPass" class="md-input" name="aPass" type="password" data-validation="length" data-validation-length="max255" data-validation-error-msg="Password too long. Maximum length is 25 characters." />
                                         </div>
                                         <div class="uk-margin-medium-bottom">
                                             <label for="aPassConfirm">Confirm Password</label>
-                                            <input id="aPassConfirm" class="md-input" name="aPassConfirm" type="password" />
+                                            <input id="aPassConfirm" class="md-input" name="aPassConfirm" type="password" data-validation="length" data-validation-length="max255" data-validation-error-msg="Password too long. Maximum length is 25 characters." />
                                         </div>
                                         <div class="uk-margin-medium-bottom">
                                             <label for="aEmail">Email</label>
-                                            <input id="aEmail" class="md-input" name="aEmail" type="email" value="{{data.account.email}}"/>
+                                            <input id="aEmail" class="md-input" name="aEmail" type="email" value="{{data.account.email}}" data-validation="email" data-validation-error-msg="Please enter a valid email address."/>
                                         </div>
                                         <div class="uk-clearfix">
                                             <button type="submit" class="uk-float-right md-btn md-btn-small md-btn-success md-btn-wave-light" ng-click="updateUser($event)">Save</button>

programming_language: HTML