CVE-2023-27485 (published 2023-03-07T19:15Z)

thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to query `subresults` from other users due to insufficient authorisation. This is only possible for logged-in users and it is not possible to associate the subresults with a specific user. This bug was fixed in commit `f1ae67d8bb2`and released with version 1.5.3. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/thm-mni-ii/feedbacksystem
commit_details: repo_url: https://github.com/thm-mni-ii/feedbacksystem
author: Jonas Kuche
author_date: 2023-03-07 13:21:08+01:00
msg: Merge pull request from GHSA-fhq8-p3w6-mmgr
repository: repo_url: https://github.com/thm-mni-ii/feedbacksystem
repo_name: thm-mni-ii/feedbacksystem
description: Intelligent, personalized feedback for students using artificial intelligence
repo_language: Scala
owner: thm-mni-ii
file_changes: filename: SubmissionController.scala
change_type: ModificationType.MODIFY
diff: @@ -97,7 +97,7 @@ class SubmissionController {
       List()
     } else {
       checkerConfigurationService.getAll(cid, tid).headOption match {
-        case Some(cc) => checkrunnerSubTaskServer.listResultsWithTasks(cc.id, sid)
+        case Some(cc) => checkrunnerSubTaskServer.listResultsWithTasks(uid, cc.id, sid)
         case None => throw new ResourceNotFoundException()
       }
     }

programming_language: Scala
filename: CheckrunnerSubTaskService.scala
change_type: ModificationType.MODIFY
diff: @@ -111,12 +111,13 @@ class CheckrunnerSubTaskService {
     * @param submissionId The id of the submission to get the subtasks results
     * @return List of subtasks results with tasks
     */
-  def listResultsWithTasks(configurationId: Int, submissionId: Int): List[SubTaskResult] = DB.query(
-    "SELECT st.name, st.points AS max_points, str.points FROM checkrunner_sub_task_result str JOIN " +
-      "checkrunner_sub_task st ON str.sub_task_id = st.sub_task_id " +
-      "WHERE str.configuration_id = ? AND str.submission_id = ?",
+  def listResultsWithTasks(userId: Int, configurationId: Int, submissionId: Int): List[SubTaskResult] = DB.query(
+    "SELECT st.name, st.points AS max_points, str.points FROM checkrunner_sub_task_result str " +
+      "JOIN checkrunner_sub_task st ON str.sub_task_id = st.sub_task_id " +
+      "JOIN user_task_submission uts ON str.submission_id = uts.submission_id " +
+      "WHERE str.configuration_id = ? AND str.submission_id = ? AND uts.user_id = ?",
     (res, _) => parseSubTaskResultWithSubTask(res),
-    configurationId, submissionId
+    configurationId, submissionId, userId
   )
 
   /**

programming_language: Scala