GHSA-qcqv-38jg-2r43

Suggest an improvement
Source
https://github.com/advisories/GHSA-qcqv-38jg-2r43
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-qcqv-38jg-2r43/GHSA-qcqv-38jg-2r43.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qcqv-38jg-2r43
Published
2022-09-15T03:21:41Z
Modified
2024-12-06T05:27:05.199086Z
Summary
Pageflow vulnerable to insecure direct object reference in membership update endpoint
Details

Impact

Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to (including their own). While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending arbitrary HTTP request to craft a request to the /admin/users/{user_id}/memberships/{membership_id} endpoint containing an additional membership[entity_id] parameter. This parameter is honored when the membership is updated, allowing an attacker to update the membership object associated with their own account (with manager role) to be associated with a different attacker-chosen account instead. Since account_ids are enumerable, an attacker can compromise all accounts present on the platform.

Mitigation

Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem.

For more information

If you have any questions or comments about this advisory email us at info(at)codevise.de

Credits

Positive Security

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-15T03:21:41Z"
}
References

Affected packages

RubyGems / pageflow

Package

Name
pageflow
Purl
pkg:gem/pageflow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
14.5.2

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.1.0
0.2.0
0.2.1
0.3.0
0.4.0
0.5.0
0.6.0
0.7.0
0.7.1
0.7.2
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.10.0
0.11.0
0.11.1
0.11.2
0.11.3
0.11.4

12.*

12.0.0.rc1
12.0.0.rc2
12.0.0.rc3
12.0.0.rc4
12.0.0.rc5
12.0.0.rc6
12.0.0.rc7
12.0.0
12.0.1
12.0.2
12.0.3
12.0.4
12.1.0
12.2.0
12.3.0
12.4.0
12.4.1
12.5.0
12.6.0

13.*

13.0.0.beta1
13.0.0.beta2
13.0.0.beta3
13.0.0.beta4
13.0.0.beta5
13.0.0.beta6
13.0.0.beta7
13.0.0.rc1
13.0.0
13.1.0
13.2.0
13.3.0
13.4.0
13.5.0
13.6.0

14.*

14.0.0.beta1
14.0.0.beta2
14.0.0.beta3
14.0.0.rc1
14.0.0.rc2
14.0.0
14.1.0
14.1.1
14.2.0
14.2.1
14.3.0
14.4.0
14.5.0
14.5.1

RubyGems / pageflow

Package

Name
pageflow
Purl
pkg:gem/pageflow

Affected ranges

Type
ECOSYSTEM
Events
Introduced
15.0.0
Fixed
15.7.1

Affected versions

15.*

15.0.0
15.0.1
15.0.2
15.1.0.beta1
15.1.0.beta2
15.1.0.beta3
15.1.0.beta4
15.1.0.beta5
15.1.0.beta6
15.1.0.rc0
15.1.0
15.1.1
15.1.2
15.2.0
15.2.1
15.2.2
15.3.0
15.4.0
15.5.0
15.6.0
15.6.1
15.7.0