CVE-2022-2595 (published 2022-08-01T15:15Z)

Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.

CVSS v3 base score: 10.0, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-285
cwe_name: Improper Authorization
description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied consistently - or not at all - users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/kromitgmbh/titra
commit_details: repo_url: https://github.com/kromitgmbh/titra
author: Fabian Kromer
author_date: 2022-06-27 19:14:15+02:00
msg: 🐛 fixed a bug in the oidc configuration preventing saving changes
🔒 fixed admin authorization validation for all administration pages
🔒 fixed a stored XSS vulnerability in the task functionality
repository: repo_url: https://github.com/kromitgmbh/titra
repo_name: kromitgmbh/titra
description: titra - modern open source project time tracking for freelancers and small teams
repo_language: JavaScript
owner: kromitgmbh
file_changes: filename: methods.js
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 import CustomFields from '../customfields.js'
-import { checkAuthentication } from '../../../utils/server_method_helpers'
+import { checkAdminAuthentication } from '../../../utils/server_method_helpers'
 
 Meteor.methods({
   addCustomField: function addCustomField({
@@ -10,7 +10,7 @@ Meteor.methods({
     check(type, String)
     check(desc, String)
     check(possibleValues, Match.Maybe([String]))
-    checkAuthentication(this)
+    checkAdminAuthentication(this)
     if (CustomFields.findOne({ name })) {
       throw new Meteor.Error('error-custom-field-exists', 'Custom field already exists', { method: 'addCustomField' })
     }
@@ -28,7 +28,7 @@ Meteor.methods({
   },
   removeCustomField: function removeCustomField({ _id }) {
     check(_id, String)
-    checkAuthentication(this)
+    checkAdminAuthentication(this)
     if (!CustomFields.findOne({ _id })) {
       throw new Meteor.Error('error-custom-field-not-found', 'Custom field not found', { method: 'removeCustomField' })
     }
@@ -37,7 +37,7 @@ Meteor.methods({
   updateCustomField: function updateCustomField({
     _id, desc, type, possibleValues,
   }) {
-    checkAuthentication(this)
+    checkAdminAuthentication(this)
     check(_id, String)
     check(type, String)
     check(desc, String)

programming_language: JavaScript
filename: methods.js
change_type: ModificationType.MODIFY
diff: @@ -1,10 +1,10 @@
 import AdmZip from 'adm-zip'
 import Extensions from './extensions'
-import { checkAuthentication } from '../../utils/server_method_helpers'
+import { checkAdminAuthentication } from '../../utils/server_method_helpers'
 
 Meteor.methods({
   addExtension({ zipFile }) {
-    checkAuthentication(this)
+    checkAdminAuthentication(this)
     const regex = /^data:.+\/(.+);base64,(.*)$/
     const matches = zipFile.match(regex)
     const data = matches[2]
@@ -36,7 +36,7 @@ Meteor.methods({
     return new Meteor.Error('Extension has been added before.')
   },
   removeExtension({ extensionId }) {
-    checkAuthentication(this)
+    checkAdminAuthentication(this)
     const extension = Extensions.findOne({ _id: extensionId })
     if (extension) {
       Extensions.remove({ _id: extension._id })
@@ -45,7 +45,7 @@ Meteor.methods({
     return new Meteor.Error('Extension does not exist.')
   },
   launchExtension({ extensionId }) {
-    checkAuthentication(this)
+    checkAdminAuthentication(this)
     const extension = Extensions.findOne({ _id: extensionId })
     if (extension) {
       eval(extension.server)
@@ -54,7 +54,7 @@ Meteor.methods({
     return new Meteor.Error('Extension does not exist')
   },
   toggleExtensionState({ extensionId, state }) {
-    checkAuthentication(this)
+    checkAdminAuthentication(this)
     const extension = Extensions.findOne({ _id: extensionId })
     if (extension) {
       Extensions.update({ _id: extension._id }, { $set: { isActive: state } })

programming_language: JavaScript
filename: methods.js
change_type: ModificationType.MODIFY
diff: @@ -30,10 +30,11 @@ Meteor.methods({
     }
   },
   updateOidcSettings(configuration) {
+    check(configuration, Object)
     checkAdminAuthentication(this)
     ServiceConfiguration.configurations.remove({
       service: 'oidc',
     })
     ServiceConfiguration.configurations.insert(configuration)
-  }
+  },
 })

programming_language: TypeScript
filename: projectTasks.js
change_type: ModificationType.MODIFY
diff: @@ -87,7 +87,7 @@ Template.projectTasks.onRendered(() => {
       const ganttTasks = tasks.fetch()?.map((task) => (
         {
           id: task._id,
-          name: task.name,
+          name: $('span').text(task.name).get(0).innerHTML,
           start: dayjs(task.start).format('YYYY-MM-DD'),
           end: dayjs(task.end).format('YYYY-MM-DD'),
           dependencies: task.dependencies,

programming_language: JavaScript
filename: administration.js
change_type: ModificationType.MODIFY
diff: @@ -289,7 +289,7 @@ Template.administration.events({
     }
 
     // Fetch the value of each input field
-    Oidc.fields.forEach((field) => {
+    oidcFields.forEach((field) => {
       configuration[field.property] = document.getElementById(
         `configure-oidc-${field.property}`
       ).value.replace(/^\s*|\s*$/g, '') // trim() doesnt work on IE8

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 {
   "name": "titra",
-  "version": "0.79.0",
+  "version": "0.79.1",
   "private": true,
   "scripts": {
     "start": "meteor run"

programming_language: JavaScript