Improper Access Control in microweber/microweber

Valid

Reported on

Jan 2nd 2022


Description

Access Controls are used in an application to restrict a user to access only intended functions. If the user is able to access any feature/function which is not allowed by the application and user gets successful in this attempt, then it will be considered as broken access control vulnerability. In this vulnerability, the normal user (i.e. not admin) is able to steal sensitive information of other users like laraval_session auth cookie, cart orders, order payment details, user email, user address and much more.

Proof of Concept

1 Create an account as a normal user and visit

https://demo.microweber.org/demo/api/users/export_my_data?user_id=1

NOTE: In above url, keep replacing the user_id to other numbers like 2, 3 and so on.. to get other users information.

Impact

Attacker can steal sensitive information of other users like laraval_session auth cookie, cart orders, order payment details, user email, user address and much more.

We are processing your report and will contact the microweber team within 24 hours. 5 months ago
Rohan Sharma submitted a
5 months ago
Rohan Sharma submitted a
5 months ago
Rohan Sharma
5 months ago

Researcher


Submitted the updated patch. Earlier, I was accessing logged-in user's user_id via mw()->user_manager->id(), but now accessing it via user_id() function

We have contacted a member of the microweber team and are waiting to hear back 5 months ago
We have sent a follow up to the microweber team. We will try again in 7 days. 5 months ago
We have sent a second follow up to the microweber team. We will try again in 10 days. 4 months ago
Bozhidar
4 months ago

Maintainer


its fixed

Peter Ivanov validated this vulnerability 4 months ago
Rohan Sharma has been awarded the disclosure bounty
The fix bounty is now up for grabs
Peter Ivanov confirmed that a fix has been merged on e680e1 4 months ago
Peter Ivanov has been awarded the fix bounty
api.php#L12-L46 has been validated
Bozhidar
4 months ago

Maintainer


https://github.com/microweber/microweber/commit/e17f3e94289b2dac7187e8039e1a3429779e273c

to join this conversation