CVE-2021-25973 (published 2021-11-02T07:15Z)

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-669
cwe_name: Incorrect Resource Transfer Between Spheres
description: The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/publify/publify
commit_details: repo_url: https://github.com/publify/publify
author: Matijs van Zuijlen
author_date: 2021-10-10 10:05:32+02:00
msg: Disallow registration rather than hiding it

Previously, the allow_signup setting only hid the signup link from the
login page. With this change, the registration functionality itself is
also disabled.
repository: repo_url: https://github.com/publify/publify
repo_name: publify/publify
description: A self hosted Web publishing platform on Rails.
repo_language: Less
owner: publify
file_changes: filename: Manifest.txt
change_type: ModificationType.MODIFY
diff: @@ -142,6 +142,7 @@ app/controllers/tags_controller.rb
 app/controllers/text_controller.rb
 app/controllers/textfilter_controller.rb
 app/controllers/theme_controller.rb
+app/controllers/users/registrations_controller.rb
 app/controllers/xml_controller.rb
 app/helpers/admin/base_helper.rb
 app/helpers/admin/feedback_helper.rb

programming_language: Shell
filename: registrations_controller.rb
change_type: ModificationType.ADD
diff: @@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+class Users::RegistrationsController < Devise::RegistrationsController
+  include BlogHelper
+  before_action :require_signup_allowed
+
+  private
+
+  def require_signup_allowed
+    render plain: "Not found", status: :not_found unless this_blog.allow_signup?
+  end
+end

programming_language: Ruby
filename: routes.rb
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 Rails.application.routes.draw do
-  devise_for :users
+  devise_for :users, controllers: { registrations: "users/registrations" }
+
   # TODO: use only in archive sidebar. See how made other system
   get ":year/:month", to: "articles#index", year: /\d{4}/, month: /\d{1,2}/,
                       as: "articles_by_month", format: false

programming_language: Ruby
filename: signup_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -4,9 +4,6 @@ require "rails_helper"
 
 RSpec.feature "Signing up", type: :feature do
   before do
-    stub_request(:get,
-                 "http://www.google.com/search?output=rss&q=link:www.example.com&tbm=blg").
-      to_return(status: 200, body: "", headers: {})
     load Rails.root.join("db/seeds.rb")
     Blog.first.update(blog_name: "Awesome!",
                       base_url: "http://www.example.com/",
@@ -40,6 +37,18 @@ RSpec.feature "Signing up", type: :feature do
     expect(page).to have_text I18n.t!("devise.sessions.signed_in")
 
     # Confirm proper setting fo user properties
-    expect(User.last.email).to eq "hello@hello.com"
+    u = User.last
+    expect(u.email).to eq "hello@hello.com"
+    expect(u.profile).to eq "contributor"
+  end
+
+  scenario "Disallow account sign-up link with a blog setting" do
+    Blog.first.update(allow_signup: 0)
+    visit admin_dashboard_path
+    expect(page).not_to have_link I18n.t("accounts.create_account")
+
+    visit new_user_registration_path
+
+    expect(page.status_code).to eq 404
   end
 end

programming_language: Ruby