CVE-2022-1698 (published 2022-05-12T16:15Z)

Allowing long password leads to denial of service in GitHub repository causefx/organizr prior to 2.1.2000. This vulnerability can be abused by doing a DDoS attack for which genuine users will not able to access resources/applications.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-191
cwe_name: Integer Underflow (Wrap or Wraparound)
description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
extended_description: This can happen in signed and unsigned cases.
         

Fix information:
repo_url: https://github.com/causefx/organizr
commit_details: repo_url: https://github.com/causefx/organizr
author: CauseFX
author_date: 2022-05-11 13:51:55-07:00
msg: fix more lengths of user inputs
repository: repo_url: https://github.com/causefx/organizr
repo_name: causefx/Organizr
description: HTPC/Homelab Services Organizer - Written in PHP
repo_language: PHP
owner: causefx
file_changes: filename: organizr.class.php
change_type: ModificationType.MODIFY
diff: @@ -5112,6 +5112,9 @@ class Organizr
 				$this->setAPIResponse('error', 'Tab name: ' . $array['name'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['name'], 50, true)) {
+				return false;
+			}
 		} else {
 			$this->setAPIResponse('error', 'Tab name was not supplied', 422);
 			return false;
@@ -5162,6 +5165,9 @@ class Organizr
 				$this->setAPIResponse('error', 'Tab name: ' . $array['name'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['name'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('default', $array)) {
 			if ($array['default']) {
@@ -5248,6 +5254,9 @@ class Organizr
 				$this->setAPIResponse('error', 'Category name: ' . $array['category'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['category'], 50, true)) {
+				return false;
+			}
 		} else {
 			$this->setAPIResponse('error', 'Category name was not supplied', 422);
 			return false;
@@ -5296,6 +5305,9 @@ class Organizr
 				$this->setAPIResponse('error', 'Category name: ' . $array['category'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['category'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('image', $array)) {
 			$array['image'] = $this->sanitizeUserString($array['image']);
@@ -6487,6 +6499,9 @@ class Organizr
 				$this->setAPIResponse('error', 'Username: ' . $array['username'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['username'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('email', $array)) {
 			if ($array['email'] == '') {
@@ -6503,6 +6518,9 @@ class Organizr
 				$this->setAPIResponse('error', 'Email: ' . $array['email'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['email'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('group_id', $array)) {
 			if ($array['group_id'] == '') {
@@ -6622,6 +6640,15 @@ class Organizr
 			$this->setResponse(409, 'Email is not a valid email', ['email' => $email]);
 			return false;
 		}
+		if (!$this->qualifyLength($username, 50, true)) {
+			return false;
+		}
+		if (!$this->qualifyLength($email, 50, true)) {
+			return false;
+		}
+		if (!$this->qualifyLength($password, 200, true)) {
+			return false;
+		}
 		$this->setLoggerChannel('User Management');
 		if ($this->createUser($username, $password, $email)) {
 			$this->logger->info('Account created for [' . $username . ']');
@@ -6660,6 +6687,15 @@ class Organizr
 			$this->setAPIResponse('error', 'Username: ' . $username . ' or Email: ' . $email . ' is already taken', 409);
 			return false;
 		}
+		if (!$this->qualifyLength($username, 50, true)) {
+			return false;
+		}
+		if (!$this->qualifyLength($email, 50, true)) {
+			return false;
+		}
+		if (!$this->qualifyLength($password, 200, true)) {
+			return false;
+		}
 		$defaults = $this->getDefaultGroup();
 		$userInfo = [
 			'username' => $username,
@@ -6714,6 +6750,9 @@ class Organizr
 				$this->setAPIResponse('error', 'Group name: ' . $array['group'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['group'], 50, true)) {
+				return false;
+			}
 		}
 		if (array_key_exists('image', $array)) {
 			if ($array['image'] == '') {
@@ -6794,6 +6833,9 @@ class Organizr
 				$this->setAPIResponse('error', 'Group name: ' . $array['group'] . ' is already taken', 409);
 				return false;
 			}
+			if (!$this->qualifyLength($array['group'], 50, true)) {
+				return false;
+			}
 		} else {
 			$this->setAPIResponse('error', 'Group name was not supplied', 422);
 			return false;

programming_language: PHP