CVE-2022-23055 - Missing Authorization

Severity

54%

Complexity

27%

Confidentiality

41%

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat messages of groups that they do not belong to, and of other users.

CVSS 3.1 Base Score 5.4. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVSS 2.0 Base Score 5.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:N).

Demo Examples

Missing Authorization

CWE-862

This function runs an arbitrary SQL query on a given database, returning the result of the query.


               
$employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);
return $preparedStatement->fetchAll();//Use a prepared statement to avoid CWE-89
/.../

While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database.

Missing Authorization

CWE-862

The following program could be part of a bulletin board system that allows users to send private messages to each other. This program intends to authenticate the user before deciding whether a private message should be displayed. Assume that LookupMessageObject() ensures that the $id argument is numeric, constructs a filename based on that id, and reads the message details from that file. Also assume that the program stores all private messages for all users in the same directory.


               
DisplayPrivateMessage($id);
print "Body: " . encodeHTML($Message->{body}) . "\n";
# For purposes of this example, assume that CWE-309 and# CWE-523 do not apply.
ExitError("invalid username or password");

While the program properly exits if authentication fails, it does not ensure that the message is addressed to the user. As a result, an authenticated attacker could provide any arbitrary identifier and read private messages that were intended for other users.

One way to avoid this problem would be to ensure that the "to" field in the message object matches the username of the authenticated user.

Overview

Type

Frappe ERPNext 11.0.3 Beta

First reported 2 years ago

2022-06-22 09:15:00

Last updated 2 years ago

2022-10-29 02:45:00

Affected Software

Frappe ERPNext 11.0.3 Beta 2

11.0.3

Frappe ERPNext 11.0.3 Beta 3

11.0.3

Frappe ERPNext 11.0.3 Beta 4

11.0.3

Frappe ERPNext 11.0.3 Beta 5

11.0.3

Frappe ERPNext 11.0.3 Beta 6

11.0.3

Frappe ERPNext 11.0.3 Beta 7

11.0.3

Frappe ERPNext 11.0.3 Beta 8

11.0.3

Frappe ERPNext 11.0.3 Beta 9

11.0.3

Frappe ERPNext 11.0.3 Beta 10

11.0.3

Frappe ERPNext 11.0.3 Beta 11

11.0.3

Frappe ERPNext 11.0.3 Beta 12

11.0.3

Frappe ERPNext 11.0.3 Beta 13

11.0.3

Frappe ERPNext 11.0.3 Beta 14

11.0.3

Frappe ERPNext 11.0.3 Beta 15

11.0.3

Frappe ERPNext 11.0.3 Beta 16

11.0.3

Frappe ERPNext 11.0.3 Beta 17

11.0.3

Frappe ERPNext 11.0.3 Beta 18

11.0.3

Frappe ERPNext 11.0.3 Beta 19

11.0.3

Frappe ERPNext 11.0.3 Beta 20

11.0.3

Frappe ERPNext 11.0.3 Beta 21

11.0.3

Frappe ERPNext 11.0.3 Beta 22

11.0.3

Frappe ERPNext 11.0.3 Beta 23

11.0.3

Frappe ERPNext 11.0.3 Beta 24

11.0.3

Frappe ERPNext 11.0.3 Beta 25

11.0.3

Frappe ERPNext 11.0.3 Beta 26

11.0.3

Frappe ERPNext 11.0.3 Beta 27

11.0.3

Frappe ERPNext 11.0.3 Beta 28

11.0.3

Frappe ERPNext 11.0.3 Beta 29

11.0.3

Frappe ERPNext 11.0.3 Beta 30

11.0.3

Frappe ERPNext 11.0.3 Beta 31

11.0.3

Frappe ERPNext 11.0.3 Beta 32

11.0.3

Frappe ERPNext 11.0.3 Beta 33

11.0.3

Frappe ERPNext 11.0.3 Beta 34

11.0.3

Frappe ERPNext 11.0.3 Beta 35

11.0.3

Frappe ERPNext 11.0.3 Beta 36

11.0.3

Frappe ERPNext 11.0.3 Beta 37

11.0.3

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.