CVE-2024-36399 (published 2024-06-06T16:15Z)

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/kanboard/kanboard
commit_details: repo_url: https://github.com/kanboard/kanboard
author: Frédéric Guillot
author_date: 2024-06-03 15:20:54-07:00
msg: Add CSRF check and remove project_id form value for addUser/addGroup actions
repository: repo_url: https://github.com/kanboard/kanboard
repo_name: kanboard/kanboard
description: Kanban project management software
repo_language: PHP
owner: kanboard
file_changes: filename: ProjectPermissionController.php
change_type: ModificationType.MODIFY
diff: @@ -66,6 +66,8 @@ class ProjectPermissionController extends BaseController
      */
     public function addUser()
     {
+        $this->checkCSRFForm();
+
         $project = $this->getProject();
         $values = $this->request->getValues();
 
@@ -75,7 +77,7 @@ class ProjectPermissionController extends BaseController
 
         if (empty($values['user_id'])) {
             $this->flash->failure(t('User not found.'));
-        } elseif ($this->projectUserRoleModel->addUser($values['project_id'], $values['user_id'], $values['role'])) {
+        } elseif ($this->projectUserRoleModel->addUser($project['id'], $values['user_id'], $values['role'])) {
             $this->flash->success(t('Project updated successfully.'));
         } else {
             $this->flash->failure(t('Unable to update this project.'));
@@ -144,6 +146,8 @@ class ProjectPermissionController extends BaseController
      */
     public function addGroup()
     {
+        $this->checkCSRFForm();
+
         $project = $this->getProject();
         $values = $this->request->getValues();
 

programming_language: PHP
filename: groups.php
change_type: ModificationType.MODIFY
diff: @@ -37,7 +37,6 @@
     <div class="panel">
         <form method="post" action="<?= $this->url->href('ProjectPermissionController', 'addGroup', array('project_id' => $project['id'])) ?>" autocomplete="off" class="form-inline">
             <?= $this->form->csrf() ?>
-            <?= $this->form->hidden('project_id', array('project_id' => $project['id'])) ?>
             <?= $this->form->hidden('group_id', $values) ?>
             <?= $this->form->hidden('external_id', $values) ?>
 

programming_language: PHP
filename: users.php
change_type: ModificationType.MODIFY
diff: @@ -35,7 +35,6 @@
     <div class="panel">
         <form method="post" action="<?= $this->url->href('ProjectPermissionController', 'addUser', array('project_id' => $project['id'])) ?>" autocomplete="off" class="form-inline">
             <?= $this->form->csrf() ?>
-            <?= $this->form->hidden('project_id', array('project_id' => $project['id'])) ?>
             <?= $this->form->hidden('user_id', $values) ?>
             <?= $this->form->hidden('username', $values) ?>
             <?= $this->form->hidden('external_id', $values) ?>

programming_language: PHP