Description
Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no share can submit arbitrary entry_ids to modify other members' transaction dates, names, notes, categories, merchants and tags, corrupting budgets and reports.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
we-promise sure
Default version status: unaffected
0.7.0 to ≤ 0.7.6-alpha.6affected
References
- https://github.com/we-promise/sure/issues/2099 ↗
- https://hackmd.io/@hieuPenguinnn/we-promise-sure-transactions-bulk-update-missing-authz ↗
- https://github.com/we-promise/sure/blob/a3bb5d991f9b96e335e9212b1a6324289577f143/app/controllers/transactions/bulk_updates_controller.rb#L5-L13 ↗
- https://github.com/we-promise/sure ↗
- https://www.vulncheck.com/advisories/sure-0.7.0-through-0.7.6-alpha.6-missing-authorization-via-transaction-bulk-update ↗