Critical Security Alert #2389194

[entrotech]

Describe the bug

ITA reported a Critical Security Bug, which they all Alert # 2389194. This is a vulnerability in the Update Account feature, where a malicious user can create their own account, and modify a PUT request to the endpoint for updating an account to update a different users account. This feature should be disabled until it can be better secured.

Steps

• It looks like the endpoint is not secured properly, allowing a malicious user to impersonate a different user.
• Either fix the vulnerabilty or disable the feature until it can be secured properly.

References

Alert2486073.pdf

[entrotech]

Fixed vulnerability by modifying the controller method for /api/accounts/:id/updateAccount to be just /api/accounts/updateAccount, and for the corresponding controller method to retrieve the user's id from the JWT, rather than the web api request url or body. This way, an authenticated user can only update their own login.

The required Hotfix 0.2.50 in production, as well as PR #1693 to do a more comprehensive fix to development.