CVE-2021-25954 (published 2021-08-09T17:15Z)

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/Dolibarr/dolibarr
commit_details: repo_url: https://github.com/Dolibarr/dolibarr
author: Laurent Destailleur
author_date: 2021-05-09 12:50:46+02:00
msg: Fix vulnerabiity: External users can set a public note
repository: repo_url: https://github.com/Dolibarr/dolibarr
repo_name: Dolibarr/dolibarr
description: Dolibarr ERP CRM is a modern software package to manage your company or foundation's activity (contacts, suppliers, invoices, orders, stocks, agenda, accounting, ...). it's an open source Web application (written in PHP) designed for businesses of any sizes, foundations and freelancers.
repo_language: PHP
owner: Dolibarr
file_changes: filename: actions_setnotes.inc.php
change_type: ModificationType.MODIFY
diff: @@ -67,16 +67,18 @@ if ($action == 'setnote_public' && !empty($permissionnote) && !GETPOST('cancel',
 			}
 		}
 	}
-} elseif ($action == 'setnote_private' && !empty($permissionnote) && !GETPOST('cancel', 'alpha')) {
-	// Set public note
-	if (empty($action) || !is_object($object) || empty($id)) {
-		dol_print_error('', 'Include of actions_setnotes.inc.php was done but required variable was not set before');
-	}
-	if (empty($object->id)) {
-		$object->fetch($id); // Fetch may not be already done
-	}
-	$result = $object->update_note(dol_html_entity_decode(GETPOST('note_private', 'restricthtml'), ENT_QUOTES | ENT_HTML5), '_private');
-	if ($result < 0) {
-		setEventMessages($object->error, $object->errors, 'errors');
+} elseif ($action == 'setnote_private' && !empty($permissionnote) && !GETPOST('cancel', 'alpha')) {	// Set public note
+	if (empty($user->socid)) {
+		// Private notes (always hidden to external users)
+		if (empty($action) || !is_object($object) || empty($id)) {
+			dol_print_error('', 'Include of actions_setnotes.inc.php was done but required variable was not set before');
+		}
+		if (empty($object->id)) {
+			$object->fetch($id); // Fetch may not be already done
+		}
+		$result = $object->update_note(dol_html_entity_decode(GETPOST('note_private', 'restricthtml'), ENT_QUOTES | ENT_HTML5), '_private');
+		if ($result < 0) {
+			setEventMessages($object->error, $object->errors, 'errors');
+		}
 	}
 }

programming_language: PHP