CVE-2022-3173 (published 2022-09-17T07:15Z)

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/snipe/snipe-it
commit_details: repo_url: https://github.com/snipe/snipe-it
author: snipe
author_date: 2022-09-16 14:00:27-07:00
msg: Check for licenses.files permissions

Signed-off-by: snipe <snipe@snipe.net>
repository: repo_url: https://github.com/snipe/snipe-it
repo_name: snipe/snipe-it
description: A free open source IT asset/license management system
repo_language: PHP
owner: snipe
file_changes: filename: LicenseFilesController.php
change_type: ModificationType.MODIFY
diff: @@ -135,6 +135,7 @@ class LicenseFilesController extends Controller
         // the license is valid
         if (isset($license->id)) {
             $this->authorize('view', $license);
+            $this->authorize('licenses.files', $license);
 
             if (! $log = Actionlog::find($fileId)) {
                 return response('No matching record for that asset/file', 500)
@@ -171,6 +172,6 @@ class LicenseFilesController extends Controller
             }
         }
 
-        return redirect()->route('license.index')->with('error', trans('admin/licenses/message.does_not_exist', ['id' => $fileId]));
+        return redirect()->route('licenses.index')->with('error', trans('admin/licenses/message.does_not_exist', ['id' => $fileId]));
     }
 }

programming_language: PHP
filename: LicensePolicy.php
change_type: ModificationType.MODIFY
diff: @@ -42,8 +42,12 @@ class LicensePolicy extends CheckoutablePermissionsPolicy
      * @param  \App\Models\User  $user
      * @return mixed
      */
-    public function files(User $user)
+    public function viewFiles(User $user)
     {
-        return $user->hasAccess($this->columnName().'.files');
+        if ($user->hasAccess('licenses.files'))  {
+            return true;
+        }
+        return false;
+
     }
 }

programming_language: PHP
filename: SnipePermissionsPolicy.php
change_type: ModificationType.MODIFY
diff: @@ -61,6 +61,11 @@ abstract class SnipePermissionsPolicy
         return $user->hasAccess($this->columnName().'.view');
     }
 
+    public function files(User $user, $item = null)
+    {
+        return $user->hasAccess($this->columnName().'.files');
+    }
+
     /**
      * Determine whether the user can create accessories.
      *

programming_language: PHP
filename: AuthServiceProvider.php
change_type: ModificationType.MODIFY
diff: @@ -122,6 +122,13 @@ class AuthServiceProvider extends ServiceProvider
         });
 
 
+        Gate::define('licenses.files', function ($user) {
+            if ($user->hasAccess('licenses.files')) {
+                return true;
+            }
+        });
+
+
         // -----------------------------------------
         // Reports
         // -----------------------------------------

programming_language: PHP
filename: message.php
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
 
 return array(
 
-    'does_not_exist' => 'License does not exist.',
+    'does_not_exist' => 'License does not exist or you do not have permission to view it.',
     'user_does_not_exist' => 'User does not exist.',
     'asset_does_not_exist' 	=> 'The asset you are trying to associate with this license does not exist.',
     'owner_doesnt_match_asset' => 'The asset you are trying to associate with this license is owned by somene other than the person selected in the assigned to dropdown.',

programming_language: PHP
filename: view.blade.php
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,8 @@
 
             </a>
         </li>
-        
+
+        @can('licenses.files', $license)
         <li>
           <a href="#files" data-toggle="tab">
             <span class="hidden-lg hidden-md">
@@ -46,6 +47,7 @@
             </span>
           </a>
         </li>
+        @endcan
 
         <li>
           <a href="#history" data-toggle="tab">
@@ -416,7 +418,7 @@
           </div> <!--/.row-->
         </div> <!-- /.tab-pane -->
 
-        @can('files', $license)
+        @can('licenses.files', $license)
         <div class="tab-pane" id="files">
           <div class="table-responsive">
             <table

programming_language: PHP