Incorrect authorization in Corteza - #VU156179

Vulnerability details

The vulnerability allows a remote attacker to overwrite other users' reminders, causing loss of access to the reminders and preventing their scheduled notifications from being delivered.

The vulnerability exists due to incorrect authorization in Corteza's ReminderService.Update when processing reminder updates: authorization checks the caller-supplied object rather than ownership of the stored reminder. A remote attacker can send PUT /system/reminder/{reminderID} with an empty JSON body {} for a known reminder ID to reassign the reminder to user 0, erase its payload and resource, and clear its scheduled time because the omitted assignedTo and the anonymous identity both default to 0.

Affected software

Remediation

External References

• https://github.com/cortezaproject/corteza/security/advisories/GHSA-j5p6-w4x8-532q

Related Security Bulletins

• Multiple vulnerabilities in Corteza