summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorcanyonknight <canyonknight@gmail.com>2012-11-29 16:54:29 -0500
committerLukas Fleischer <archlinux@cryptocrack.de>2012-11-29 23:23:10 +0100
commit87fe4701cd2e84c70c080eade1c2a0f1ffa3c6d9 (patch)
treead30778e7fcb34c6f71cf0ad7d9104f84e2a398e
parente383205edabff92f7f7c7750cd0038774c823c6b (diff)
Fix account editing and hijacking vulnerability
Checks are in place to avoid users getting account editing forms they shouldn't have access to. The appropriate checks before editing the account in the backend are not in place. This vulnerability allows a user to craft malicious POST data to edit other user accounts, thereby allowing account hijacking. Add a new flexible function can_edit_account() to determine if a user has appropriate permissions. Run the permission check before processing any account information in the backend. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
-rw-r--r--web/html/account.php11
-rw-r--r--web/lib/acctfuncs.inc.php29
2 files changed, 37 insertions, 3 deletions
diff --git a/web/html/account.php b/web/html/account.php
index 786ae02..cccdd76 100644
--- a/web/html/account.php
+++ b/web/html/account.php
@@ -73,9 +73,14 @@ if (isset($_COOKIE["AURSID"])) {
}
} elseif ($action == "UpdateAccount") {
- # user is submitting their modifications to an existing account
- #
- if (check_token()) {
+ $uid = uid_from_sid($_COOKIE['AURSID']);
+
+ /* Details for account being updated */
+ $acctinfo = account_details(in_request('ID'), in_request('U'));
+
+ /* Verify user permissions and that the request is a valid POST */
+ if (can_edit_account($atype, $acctinfo, $uid) && check_token()) {
+ /* Update the details for the existing account */
process_account_form($atype, "edit", "UpdateAccount",
in_request("U"), in_request("T"), in_request("S"),
in_request("E"), in_request("P"), in_request("C"),
diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php
index 3fd23ae..81e06b6 100644
--- a/web/lib/acctfuncs.inc.php
+++ b/web/lib/acctfuncs.inc.php
@@ -1015,3 +1015,32 @@ function cast_proposal_vote($voteid, $uid, $vote, $newtotal, $dbh=NULL) {
$q = "INSERT INTO TU_Votes (VoteID, UserID) VALUES (" . intval($voteid) . ", " . intval($uid) . ")";
$result = $dbh->exec($q);
}
+
+/**
+ * Verify a user has the proper permissions to edit an account
+ *
+ * @param string $atype Account type of the editing user
+ * @param array $acctinfo User account information for edited account
+ * @param int $uid User ID of the editing user
+ *
+ * @return bool True if permission to edit the account, otherwise false
+ */
+function can_edit_account($atype, $acctinfo, $uid) {
+ /* Developers can edit any account */
+ if ($atype == 'Developer') {
+ return true;
+ }
+
+ /* Trusted Users can edit all accounts except Developer accounts */
+ if ($atype == 'Trusted User' &&
+ $acctinfo['AccountType'] != 'Developer') {
+ return true;
+ }
+
+ /* Users can edit only their own account */
+ if ($acctinfo['ID'] == $uid) {
+ return true;
+ }
+
+ return false;
+}