Description
Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| karlomikus | bar-assistant | 6.0.0-rc1 – < 6.11.0 | 6.11.0 |
References
- GitHub Issue #641 issue-tracking
- https://github.com/karlomikus/bar-assistant product
- https://github.com/karlomikus/bar-assistant/commit/bb246d461faf8b50f7814e34b49eb6c3647d297f patch
- bar-assistant v6.11.0 Release Notes release-notes
- https://github.com/karlomikus/bar-assistant/blob/v6.10.1/app/Http/Controllers/CocktailController.php#L535 technical-description
- VulnCheck Advisory: Bar Assistant 6.0.0-rc1 before 6.11.0 Incorrect Authorization via Cocktail Copy third-party-advisory