Threats Tagged 'ghsa-243p-f3cv-c5wh'

## Summary Five Filament `groupedBulkActions` blocks across the Shopper admin Livewire pages omit the `->authorize(...)` permission gate, while their per-record sibling actions (and other Shopper Index pages such as `Pages/Settings/Currencies.php`, `Pages/Reviews/Index.php`, `Pages/Collection/Index.php`, and `Pages/Discount/Index.php`) correctly chain `->authorize(...)`. Each affected page's `mount()` only requires the read-only `browse_*` permission, so a low-privilege staff user holding only the read permission can drive the bulk endpoint via the standard Livewire `callTableBulkAction` flow and execute state-mutating operations they were never granted. The vulnerability is the same class as GHSA-f946-9qp6-vgch and GHSA-j328-xmgp-j4q3 (read-only permission gating a write action), just on a different surface (Filament 4 `groupedBulkActions` rather than top-level Livewire methods). A staff user holding only `browse_attributes` can permanently delete every product attribute in the catalog (cascading break of every dependent product variant). A user holding only `browse_tags` can permanently delete every product tag. Users holding `browse_brands`, `browse_categories`, or `browse_suppliers` can flip the visibility (`is_enabled`) of every brand/category/supplier in bulk, sabotaging storefront catalog visibility. CVSS 3.1: `AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H` = 8.1 High. CWE-285 (Improper Authorization) and CWE-862 (Missing Authorization). The attacker has low privilege (browse-only staff role), no user interaction, network reachable. ## Vulnerable components (paths relative to repo root) All references are HEAD = commit `ac9a760` on `master` (the very commit that closed the previous wave of authorization-drift bugs from GHSA-j328-xmgp-j4q3). ### 1) `packages/admin/src/Livewire/Pages/Attribute/Browse.php` Mount at line 36–39 requires only `browse_attributes`. - Lines 106–122: `DeleteBulkAction::make()` has NO `->authorize(...)` chain (the surrounding per-record `delete` action at lines 95–104 correctly does `->authorize('delete_attributes')`). - Lines 123–138: `BulkAction::make('enabled')` has NO `->authorize(...)`. - Lines 139–155: `BulkAction::make('disabled')` has NO `->authorize(...)`. Net effect: a `browse_attributes`-only user can **delete every row in the attributes table**, and toggle `is_enabled` on every attribute in one request. Deleting an attribute cascades into every product variant that references it via the `attribute_product` pivot. ### 2) `packages/admin/src/Livewire/Pages/Tag/Index.php` Mount at line 39 requires only `browse_tags`. - Lines 96–108: `DeleteBulkAction::make()` has NO `->authorize(...)` chain (the per-record `delete` action at lines 79–94 correctly does `->authorize('delete_tags')`). Net effect: a `browse_tags`-only user can delete every `ProductTag` row. ### 3) `packages/admin/src/Livewire/Pages/Brand/Index.php` Mount at line 37–40 requires only `browse_brands`. - Lines 97–112: `BulkAction::make('enabled')` has NO `->authorize(...)`. - Lines 113–129: `BulkAction::make('disabled')` has NO `->authorize(...)`. Net effect: a `browse_brands`-only user can flip `is_enabled` on every brand. Disabling all brands removes them from the storefront catalog. The per-record edit/delete actions and the `DeleteBulkAction` at lines 130–148 are correctly `->authorize(...)` gated — only the visibility bulk actions were missed. ### 4) `packages/admin/src/Livewire/Pages/Category/Index.php` Mount at line 38–41 requires only `browse_categories`. - Lines 102–117: `BulkAction::make('enabled')` has NO `->authorize(...)`. - Lines 118–133: `BulkAction::make('disabled')` has NO `->authorize(...)`. Net effect: a `browse_categories`-only user can flip `is_enabled` on every category. Same shape as Brand. ### 5) `packages/admin/src/Livewire/Pages/Supplier/Index.php` Mount at line 38 requires only `browse_suppliers`. - Lines 93–108: `BulkAction::make('enabled')` has NO `->authorize(...)`. - Lines 109–125: `BulkAction::make('disabled')` has NO `->authorize(...)`. Net effect: a `browse_suppliers`-only user can flip `is_enabled` on every supplier. ## Reference comparison: places that ARE correctly gated For reference, here is what the same pattern looks like in files that DID get the fix: - `packages/admin/src/Livewire/Pages/Settings/Currencies.php` lines 90–129: every `BulkAction` chains `->authorize('access_setting')`. - `packages/admin/src/Livewire/Pages/Reviews/Index.php` lines 105–119: `DeleteBulkAction` chains `->authorize('delete_reviews')`. - `packages/admin/src/Livewire/Pages/Collection/Index.php` lines 109–128: `DeleteBulkAction` chains `->authorize('delete_collections')`. - `packages/admin/src/Livewire/Pages/Discount/Index.php` lines 126–145: `DeleteBulkAction` chains `->authorize('delete_discounts')`. The convention is established and applied elsewhere — these five files just missed it. ## Proof of Concept The attached file `tests/Admin/Livewire/Pages/Brand/AuthBypassPocTes