CVE-2023-3230 (published 2023-06-14T06:15Z)

Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/fossbilling/fossbilling
commit_details: repo_url: https://github.com/fossbilling/fossbilling
author: Belle Aerni
author_date: 2023-06-11 21:28:36-07:00
msg: Fix logical error in Servicedownloadable module (#1311)

* Fix logical error in Servicedownloadable module

* Fix the tests now
repository: repo_url: https://github.com/fossbilling/fossbilling
repo_name: FOSSBilling/FOSSBilling
description: Empower your hosting business with FOSSBilling, the free and open-source solution for efficient billing and client management.
repo_language: PHP
owner: fossbilling
file_changes: filename: Admin.php
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,7 @@ class Admin extends \Api_Abstract
         $required = [
             'id' => 'Product ID is missing',
         ];
+
         $this->di['validator']->checkRequiredParamsForArray($required, $data);
 
         $model = $this->di['db']->getExistingModelById('Product', $data['id'], 'Product not found');

programming_language: PHP
filename: Client.php
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,7 @@ class Client extends \Api_Abstract
 
         $orderService = $this->di['mod_service']('order');
         $s = $orderService->getOrderService($order);
-        if (!$s instanceof \Model_ServiceDownloadable) {
+        if (!$s instanceof \Model_ServiceDownloadable || $order->status !== 'active') {
             throw new \Box_Exception('Order is not activated');
         }
 

programming_language: PHP
filename: ClientTest.php
change_type: ModificationType.MODIFY
diff: @@ -105,10 +105,14 @@ class ClientTest extends \BBTestCase {
             ->method('getOrderService')
             ->will($this->returnValue(new \Model_ServiceDownloadable()));
 
+        $mockOrder = new \Model_ClientOrder();
+        $mockOrder->loadBean(New \DummyBean());
+        $mockOrder->status = "active";
+
         $dbMock = $this->getMockBuilder('\Box_Database')->getMock();
         $dbMock->expects($this->atLeastOnce())
             ->method('findOne')
-            ->will($this->returnValue(new \Model_ClientOrder()));
+            ->will($this->returnValue($mockOrder));
 
         $di = new \Pimple\Container();
         $di['db'] = $dbMock;

programming_language: PHP