CVE-2024-36070 (published 2024-05-19T19:15Z)

tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via setup.php because of getRegistryData in Setup/Frontend/Json.php. (An update is also available for the 2022.11 series.)


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/tine-groupware/tine
commit_details: repo_url: https://github.com/tine-groupware/tine
author: Philipp Schüle
author_date: 2024-04-09 16:21:19+02:00
msg: fix(Setup/Frontend/Json): don't show auth data in anonymous call

thx @Christian Pöschl of usd AG

see usd-2024-0002 | Tine 2023.11.2 - Password Leakage
repository: repo_url: https://github.com/tine-groupware/tine
repo_name: tine-groupware/tine
description: tine groupware main repository
repo_language: HTML
owner: tine-groupware
file_changes: filename: Json.php
change_type: ModificationType.MODIFY
diff: @@ -269,14 +269,11 @@ class Setup_Frontend_Json extends Tinebase_Frontend_Abstract
     
     /**
      * Returns registry data of setup
-     * .
-     * @see Tinebase_Application_Json_Abstract
-     * 
-     * @return mixed array 'variable name' => 'data'
-     * 
-     * @todo add 'titlePostfix'    => Tinebase_Config::getInstance()->getConfig(Tinebase_Config::PAGETITLEPOSTFIX, NULL, '')->value here?
+     *
+     * @return array
+     * @throws Tinebase_Exception_InvalidArgument
      */
-    public function getRegistryData()
+    public function getRegistryData(): array
     {
         // anonymous registry
         $registryData =  array(
@@ -289,18 +286,23 @@ class Setup_Frontend_Json extends Tinebase_Frontend_Abstract
                 // NOTE: if assetHash is not available we have a serious problem -  please don't generate one!
                 'assetHash'     => Tinebase_Frontend_Http_SinglePageApplication::getAssetHash(),
             ),
-            'authenticationData'   => $this->loadAuthenticationData(),
         );
         
-        // authenticated or non existent config
+        // authenticated or non-existent config
         if (! Setup_Core::configFileExists() || Setup_Core::isRegistered(Setup_Core::USER)) {
             $registryData = array_merge($registryData, $this->checkConfig());
             $registryData = array_merge($registryData, array(
+                'authenticationData'   => Setup_Core::isRegistered(Setup_Core::USER)
+                    ? $this->loadAuthenticationData() : [],
                 'rights'               => ['admin'],
-                'acceptedTermsVersion' => (! empty($registryData['checkDB']) && $this->_controller->isInstalled('Tinebase')) ? Setup_Controller::getInstance()->getAcceptedTerms() : 0,
+                'acceptedTermsVersion' => (! empty($registryData['checkDB']) &&
+                    $this->_controller->isInstalled(''))
+                    ? Setup_Controller::getInstance()->getAcceptedTerms() : 0,
                 'setupChecks'          => $this->envCheck(),
                 'configData'           => $this->loadConfig(),
-                'emailData'            => (! empty($registryData['checkDB']) && $this->_controller->isInstalled('Tinebase')) ? $this->getEmailConfig() : array(),
+                'emailData'            => (! empty($registryData['checkDB'])
+                    && $this->_controller->isInstalled() && Setup_Core::isRegistered(Setup_Core::USER))
+                        ? $this->getEmailConfig() : array(),
             ));
         }
         
@@ -313,11 +315,11 @@ class Setup_Frontend_Json extends Tinebase_Frontend_Abstract
         
         return $registryData;
     }
-    
+
     /**
      * Returns registry data of all applications current user has access to
      * @see Tinebase_Application_Json_Abstract
-     * 
+     *
      * @return mixed array 'variable name' => 'data'
      *
      * TODO DRY: most of this already is part of Tinebase_Frontend_Json::_getAnonymousRegistryData
@@ -328,7 +330,7 @@ class Setup_Frontend_Json extends Tinebase_Frontend_Abstract
         Setup_Controller::getInstance()->clearCache();
 
         $registryData['Setup'] = $this->getRegistryData();
-        
+
         // setup also need some core tinebase regdata
         $locale = Tinebase_Core::get('locale');
         $symbols = Zend_Locale::getTranslationList('symbols', $locale);
@@ -338,7 +340,7 @@ class Setup_Frontend_Json extends Tinebase_Frontend_Abstract
             'timeZone'         => Setup_Core::getUserTimezone(),
             'jsonKey'          => Setup_Core::get('jsonKey'),
             'locale'           => array(
-                'locale'   => $locale->toString(), 
+                'locale'   => $locale->toString(),
                 'language' => Zend_Locale::getTranslation($locale->getLanguage(), 'language', $locale),
                 'region'   => Zend_Locale::getTranslation($locale->getRegion(), 'country', $locale),
             ),

programming_language: PHP