CVE-2024-26145 (published 2024-02-21T18:15Z)

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a workaround, one may use post visibility to limit access.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/discourse/discourse-calendar
commit_details: repo_url: https://github.com/discourse/discourse-calendar
author: Natalie Tay
author_date: 2024-02-21 15:36:36+08:00
msg: SECURITY: Disallow self invite to private events (#543)
repository: repo_url: https://github.com/discourse/discourse-calendar
repo_name: discourse/discourse-calendar
description: Adds the ability to create a dynamic calendar in the first post of a topic.
repo_language: Ruby
owner: discourse
file_changes: filename: invitees_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,8 @@ module DiscoursePostEvent
       event = Event.find(params[:post_id])
       guardian.ensure_can_see!(event.post)
 
+      raise Discourse::InvalidAccess if !event.can_user_update_attendance(current_user)
+
       invitee =
         Invitee.create_attendance!(current_user.id, params[:post_id], invitee_params[:status])
       render json: InviteeSerializer.new(invitee)

programming_language: Ruby
filename: invitees_controller_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -173,7 +173,6 @@ module DiscoursePostEvent
           post "/discourse-post-event/events/#{post_event_2.id}/invitees.json",
                params: {
                  invitee: {
-                   user_id: user.id,
                    status: "not_going",
                  },
                }
@@ -185,7 +184,6 @@ module DiscoursePostEvent
           post "/discourse-post-event/events/#{post_event_2.id}/invitees.json",
                params: {
                  invitee: {
-                   user_id: user.id,
                    status: "going",
                  },
                }
@@ -196,6 +194,24 @@ module DiscoursePostEvent
           expect(tu.notification_level).to eq(TopicUser.notification_levels[:watching])
         end
 
+        context "when someone is trying to invite themselves to a private event (creepy)" do
+          let(:post_event_2) { Fabricate(:event, post: post_1, status: "private") }
+          let(:other_user) { Fabricate(:user, username: "creep") }
+
+          before { sign_in(other_user) }
+
+          it "does not create an invitee" do
+            expect do
+              post "/discourse-post-event/events/#{post_event_2.id}/invitees.json",
+                   params: {
+                     invitee: {
+                       status: "going",
+                     },
+                   }
+            end.not_to change { post_event_2.invitees.count }
+          end
+        end
+
         context "when the invitee is the event owner" do
           let(:post_event_2) { Fabricate(:event, post: post_1) }
 

programming_language: Ruby