Summary
A Missing Authorization vulnerability (CWE-862) has been identified in the application. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the isOwnProfileOrAdmin() middleware on several push subscription API routes.
Vulnerability Details
- Type: Missing Authorization (CWE-862)
- Impact: An authenticated user can manipulate the
userId parameter in the URL to view or delete push subscriptions of other users.
- Affected Routes:
GET /:userId/pushSubscriptionsGET /:userId/pushSubscription/:endpointDELETE /:userId/pushSubscription/:endpointGET /:id/watch_data
- Root Cause: The
isOwnProfileOrAdmin() middleware is missing from these routes.
Expected Behavior
The affected routes should verify that the authenticated user is either the profile owner or an administrator before allowing access or modification of data. The isOwnProfileOrAdmin() middleware must be applied to enforce this check.
Actual Behavior
Currently, any authenticated user can access or delete push subscriptions of other users by manipulating the userId parameter in the URL.
gauthier-th Reporter
M0NsTeRRR Remediation reviewer
fallenbagel Remediation reviewer
0xSysR3ll Remediation reviewer
Summary
A Missing Authorization vulnerability (CWE-862) has been identified in the application. It allows authenticated users to access and modify data belonging to other users. This issue is due to the absence of the
isOwnProfileOrAdmin()middleware on several push subscription API routes.Vulnerability Details
userIdparameter in the URL to view or delete push subscriptions of other users.GET /:userId/pushSubscriptionsGET /:userId/pushSubscription/:endpointDELETE /:userId/pushSubscription/:endpointGET /:id/watch_dataisOwnProfileOrAdmin()middleware is missing from these routes.Expected Behavior
The affected routes should verify that the authenticated user is either the profile owner or an administrator before allowing access or modification of data. The
isOwnProfileOrAdmin()middleware must be applied to enforce this check.Actual Behavior
Currently, any authenticated user can access or delete push subscriptions of other users by manipulating the
userIdparameter in the URL.