CVE-2020-15120 (published 2020-07-27T18:15Z)

In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project\'s private code. This can be further exploited to access all bills of another project without knowledge of this other project\'s private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. This is fixed in version 4.1.5.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 4.9, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/spiral-project/ihatemoney
commit_details: repo_url: https://github.com/spiral-project/ihatemoney
author: Baptiste Jonglez
author_date: 2020-07-17 17:43:33+02:00
msg: Fix unauthorized access and modification of project data (CVE-2020-15120)

An authenticated member of one project can modify and delete members of
another project, without knowledge of this other project's private
code. This can be further exploited to access all bills of another project
without knowledge of this other project's private code.

With the default configuration, anybody is allowed to create a new
project. An attacker can create a new project and then use it to become
authenticated and exploit this flaw. As such, the exposure is similar to
an unauthenticated attack, because it is trivial to become authenticated.

This issue was caused by a wrong database queries in PersonQuery.

For more details, see https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9
repository: repo_url: https://github.com/spiral-project/ihatemoney
repo_name: spiral-project/ihatemoney
description: A simple shared budget manager web application
repo_language: Python
owner: spiral-project
file_changes: filename: models.py
change_type: ModificationType.MODIFY
diff: @@ -380,7 +380,7 @@ class Person(db.Model):
         def get_by_name(self, name, project):
             return (
                 Person.query.filter(Person.name == name)
-                .filter(Project.id == project.id)
+                .filter(Person.project_id == project.id)
                 .one()
             )
 
@@ -389,7 +389,7 @@ class Person(db.Model):
                 project = g.project
             return (
                 Person.query.filter(Person.id == id)
-                .filter(Project.id == project.id)
+                .filter(Person.project_id == project.id)
                 .one()
             )
 

programming_language: Python