CVE-2023-48218 (published 2023-11-20T17:15Z)

The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/strapi-community/strapi-plugin-protected-populate
commit_details: repo_url: https://github.com/strapi-community/strapi-plugin-protected-populate
author: Boegie19
author_date: 2023-11-13 20:53:11+01:00
msg: fix fields always populating ID
repository: repo_url: https://github.com/strapi-community/strapi-plugin-protected-populate
repo_name: strapi-community/strapi-plugin-protected-populate
repo_language: JavaScript
owner: strapi-community
file_changes: filename: protect-route.js
change_type: ModificationType.MODIFY
diff: @@ -23,12 +23,12 @@ const protectPopulate = (populate, info) => {
   //fields
   if (typeof info.on === 'undefined') {
     if (typeof info.fields === 'undefined') {
-      populate.fields = [];
+      populate.fields = ['id'];
     } else if (typeof populate.fields === 'undefined') {
       //Don't have to check main mainBoolean since if it is true fields is also "undefined"
-      populate.fields = info.fields;
+      populate.fields = ['id', ...info.fields];
     } else if (Array.isArray(populate.fields)) {
-      let fields = [];
+      let fields = ['id'];
       populate.fields.forEach((value) => {
         if (info.fields.includes(value)) {
           fields.push(value);
@@ -37,7 +37,7 @@ const protectPopulate = (populate, info) => {
       populate.fields = fields;
     } else {
       //Unexpected input handle it if it was empty
-      populate.fields = info.fields;
+      populate.fields = ['id', ...info.fields];
     }
   }
   //Deal with array input for populate
@@ -105,6 +105,7 @@ const protectPopulate = (populate, info) => {
       populate = AllowedList;
     }
   } else {
+    //DZ
     //populate
     if (typeof info.populate === 'undefined') {
       populate.populate = {};
@@ -164,7 +165,7 @@ const protectFilters = (filters, info) => {
 
 const protectRoute = (query, info) => {
   const savePopulate = protectPopulate(query, info);
-  query.populate = savePopulate.populate;
+  query.populate = savePopulate.populate || savePopulate.on;
   query.fields = savePopulate.fields;
   query.filters = protectFilters(query.filters, info);
   return query;

programming_language: TypeScript