aleksis/AlekSIS-App-Cursus

Watch

Fork 0

Unprotected subjects query #38

New issue

Closed

opened 2025-01-29 11:13:06 +01:00 by hansegucker · 7 comments

hansegucker commented

2025-01-29 11:13:06 +01:00

Owner

CLN-011 — Unprotected subjects query

Vulnerability ID: CLN-011

Vulnerability type: Information Exposure

Threat level: Moderate

Description:

Queries for the list of subjects and associated information from the GraphQL backend do not require any authentication.

Technical description:

Following the discovery of GraphQL endpoints that were not properly secured CLN-001 (page 16), we found that
queries for subjects (or the equivalent gqlsubjects) will return a list of all subjects and their teachers to an
unauthenticated request.

Example curl request:

curl -X GET https://sis5.c-b-e-s.de/graphql/ -H "Content-Type: application/json" -d '{"query":"query
subjects{ items: subjects{id name shortName teachers{id fullName}}}"}'

Example response:

{"data":{"items":[{"id":"178","name":"Biologie","shortName":"bio","teachers":
[{"id":"3446","fullName":"Dippel, Janet"},{"id":"3440","fullName":"Etzold, Kathi"},
{"id":"3434","fullName":"Zirme, Marita"}]},{"id":"177","name":"Chemie","shortName":"ch","teachers":
[{"id":"3447","fullName":"Briemer, Roswitha"},{"id":"3446","fullName":"Dippel, Janet"}]},
{"id":"179","name":"Deutsch","shortName":"de","teachers":[{"id":"3441","fullName":"Dehmel,
Elli"},{"id":"3439","fullName":"Etzold, Karl-Peter"},{"id":"3449","fullName":"M\u00fchle,
Brunhilde"},{"id":"3443","fullName":"Reinhardt, Ilka"},{"id":"3448","fullName":"Stroh, Max"}]},
{"id":"180","name":"Englisch","shortName":"en","teachers":[{"id":"3439","fullName":"Etzold, Karl-
Peter"},{"id":"3442","fullName":"Hermann, Sibylla"},{"id":"3431","fullName":"Heser, Wally"}]},
{"id":"181","name":"Franz\u00f6sisch","shortName":"fr","teachers":[{"id":"3432","fullName":"Peukert,
Zeljko"},{"id":"3444","fullName":"Schleich, Sabrina"},{"id":"3434","fullName":"Zirme, Marita"}]},
{"id":"186","name":"Geographie","shortName":"geo","teachers":[{"id":"3437","fullName":"Sauer,
Rosalia"}]},{"id":"188","name":"Informatik","shortName":"if","teachers":
[{"id":"3439","fullName":"Etzold, Karl-Peter"},{"id":"3444","fullName":"Schleich,
Sabrina"}]},{"id":"185","name":"Kunst","shortName":"ku","teachers":
[{"id":"3442","fullName":"Hermann, Sibylla"},{"id":"3430","fullName":"L\u00f6chel, Arthur"}]},
{"id":"175","name":"Mathematik","shortName":"ma","teachers":[{"id":"3446","fullName":"Dippel,
Janet"},{"id":"3433","fullName":"Ladeck, Sinaida"},{"id":"3430","fullName":"L\u00f6chel,
Arthur"},{"id":"3436","fullName":"Naser, Orhan"},{"id":"3434","fullName":"Zirme, Marita"}]},
{"id":"184","name":"Musik","shortName":"mu","teachers":[{"id":"3441","fullName":"Dehmel,
Elli"},{"id":"3430","fullName":"L\u00f6chel, Arthur"},{"id":"3448","fullName":"Stroh, Max"}]},
{"id":"187","name":"Philosophie","shortName":"ph","teachers":[{"id":"3430","fullName":"L
\u00f6chel, Arthur"}]},{"id":"176","name":"Physik","shortName":"phy","teachers":
[{"id":"3447","fullName":"Briemer, Roswitha"},{"id":"3439","fullName":"Etzold, Karl-
Peter"},{"id":"3445","fullName":"Finke, Lothar"},{"id":"3431","fullName":"Heser, Wally"}]},
{"id":"182","name":"Spanisch","shortName":"spaz","teachers":[{"id":"3438","fullName":"Harloff,
Alwina"},{"id":"3433","fullName":"Ladeck, Sinaida"},{"id":"3437","fullName":"Sauer, Rosalia"}]},
{"id":"183","name":"Sport","shortName":"sp","teachers":[{"id":"3432","fullName":"Peukert,
Zeljko"}]}]}}

Impact:

Sensitive information in the form of a complete list of the school's subjects and corresponding teachers is available to
unauthenticated users.

Recommendation:

Review the permissions protecting queries on subjects and gqlsubject to prevent unauthenticated access.

# CLN-011 — Unprotected subjects query Vulnerability ID: CLN-011 Vulnerability type: Information Exposure Threat level: Moderate ## Description: Queries for the list of subjects and associated information from the GraphQL backend do not require any authentication. ## Technical description: Following the discovery of GraphQL endpoints that were not properly secured CLN-001 (page 16), we found that queries for subjects (or the equivalent gqlsubjects) will return a list of all subjects and their teachers to an unauthenticated request. Example curl request: ``` curl -X GET https://sis5.c-b-e-s.de/graphql/ -H "Content-Type: application/json" -d '{"query":"query subjects{ items: subjects{id name shortName teachers{id fullName}}}"}' ``` Example response: ``` {"data":{"items":[{"id":"178","name":"Biologie","shortName":"bio","teachers": [{"id":"3446","fullName":"Dippel, Janet"},{"id":"3440","fullName":"Etzold, Kathi"}, {"id":"3434","fullName":"Zirme, Marita"}]},{"id":"177","name":"Chemie","shortName":"ch","teachers": [{"id":"3447","fullName":"Briemer, Roswitha"},{"id":"3446","fullName":"Dippel, Janet"}]}, {"id":"179","name":"Deutsch","shortName":"de","teachers":[{"id":"3441","fullName":"Dehmel, Elli"},{"id":"3439","fullName":"Etzold, Karl-Peter"},{"id":"3449","fullName":"M\u00fchle, Brunhilde"},{"id":"3443","fullName":"Reinhardt, Ilka"},{"id":"3448","fullName":"Stroh, Max"}]}, {"id":"180","name":"Englisch","shortName":"en","teachers":[{"id":"3439","fullName":"Etzold, Karl- Peter"},{"id":"3442","fullName":"Hermann, Sibylla"},{"id":"3431","fullName":"Heser, Wally"}]}, {"id":"181","name":"Franz\u00f6sisch","shortName":"fr","teachers":[{"id":"3432","fullName":"Peukert, Zeljko"},{"id":"3444","fullName":"Schleich, Sabrina"},{"id":"3434","fullName":"Zirme, Marita"}]}, {"id":"186","name":"Geographie","shortName":"geo","teachers":[{"id":"3437","fullName":"Sauer, Rosalia"}]},{"id":"188","name":"Informatik","shortName":"if","teachers": [{"id":"3439","fullName":"Etzold, Karl-Peter"},{"id":"3444","fullName":"Schleich, Sabrina"}]},{"id":"185","name":"Kunst","shortName":"ku","teachers": [{"id":"3442","fullName":"Hermann, Sibylla"},{"id":"3430","fullName":"L\u00f6chel, Arthur"}]}, {"id":"175","name":"Mathematik","shortName":"ma","teachers":[{"id":"3446","fullName":"Dippel, Janet"},{"id":"3433","fullName":"Ladeck, Sinaida"},{"id":"3430","fullName":"L\u00f6chel, Arthur"},{"id":"3436","fullName":"Naser, Orhan"},{"id":"3434","fullName":"Zirme, Marita"}]}, {"id":"184","name":"Musik","shortName":"mu","teachers":[{"id":"3441","fullName":"Dehmel, Elli"},{"id":"3430","fullName":"L\u00f6chel, Arthur"},{"id":"3448","fullName":"Stroh, Max"}]}, {"id":"187","name":"Philosophie","shortName":"ph","teachers":[{"id":"3430","fullName":"L \u00f6chel, Arthur"}]},{"id":"176","name":"Physik","shortName":"phy","teachers": [{"id":"3447","fullName":"Briemer, Roswitha"},{"id":"3439","fullName":"Etzold, Karl- Peter"},{"id":"3445","fullName":"Finke, Lothar"},{"id":"3431","fullName":"Heser, Wally"}]}, {"id":"182","name":"Spanisch","shortName":"spaz","teachers":[{"id":"3438","fullName":"Harloff, Alwina"},{"id":"3433","fullName":"Ladeck, Sinaida"},{"id":"3437","fullName":"Sauer, Rosalia"}]}, {"id":"183","name":"Sport","shortName":"sp","teachers":[{"id":"3432","fullName":"Peukert, Zeljko"}]}]}} ``` ## Impact: Sensitive information in the form of a complete list of the school's subjects and corresponding teachers is available to unauthenticated users. ## Recommendation: Review the permissions protecting queries on subjects and gqlsubject to prevent unauthenticated access.

hansegucker commented

2025-01-29 11:13:06 +01:00

Author

Owner

assigned to @yuha

hansegucker commented

2025-01-29 11:13:37 +01:00

Author

Owner

Action to take: This should be not visible for unauthenticated users. Authenticated users should be able to fetch all subjects, but not the connected teachers.

hansegucker commented

2025-01-29 11:13:44 +01:00

Author

Owner

made the issue confidential

permcu commented

2025-02-11 18:11:18 +01:00

(Migrated from edugit.org)

made the issue visible to everyone

permcu commented

2025-02-11 18:11:37 +01:00

(Migrated from edugit.org)

created branch 38-unprotected-subjects-query to address this issue

created branch [`38-unprotected-subjects-query`](/AlekSIS/onboarding/AlekSIS-App-Cursus/-/compare/master...38-unprotected-subjects-query) to address this issue

permcu commented

2025-02-11 18:11:52 +01:00

(Migrated from edugit.org)

mentioned in merge request !133

hansegucker closed this issue

2025-02-15 22:15:01 +01:00

hansegucker commented

2025-04-10 11:14:40 +02:00

Author

Owner

mentioned in commit f0cbe4e13e

mentioned in commit f0cbe4e13ef5c024f1a141064739fed835bd1ac6