1846472 - [HackerOne] Privilege escalation allowing non moderator users to see contents marked as spam

Status: NEW

(support.mozilla.org :: General, defect)

Description

[Frida K [:frida]]

Link: https://hackerone.com/reports/2089209
Date: 2023-07-29 08:25:33 UTC
By: tomorrowisnew_
Weakness: Privilege Escalation

Details:

Summary:

Hi. Normally, users with no can_moderate cant see questions/answers marked as spam. For example in the function question_list

    if not request.user.has_perm("flagit.can_moderate"):
        question_qs = question_qs.filter(is_spam=False)

However, the api endpoints in questions/urls_api.py forgot to have the same check. Both the QuestionViewSet and the AnswerViewSet have no filter in place if the question/answer we are viewing have been flagged

Impact

Summary:

Privilege escalation allowing non moderators users to view questions flagged as spam.

Comment 1

[Frida K [:frida]]

I was able to validate the report.

I have marked this question as spam, https://support.allizom.org/en-US/questions/1207486, and it is accessible through the API by non-moderators https://support.allizom.org/api/2/question/1207486/

I have also marked this answer as spam, https://support.allizom.org/en-US/questions/1207487#answer-1084177 and it is still accessible https://support.allizom.org/api/2/answer/1084177/.

Comment 2

[Frida K [:frida]]

Hello Tasos,

Can you please take a look?

Thanks,
Frida

Comment 3

[Tasos Katsoulas [:tasos]]

Thank Frida, I am not sure this is an actual security issue. Although we do not want spam as visible, it does not necessarily mean that we do not want them discoverable. Eg the API can be used to fetch all questions, including spam and hide them at the presentation layer. I will keep this bug open to investigate further but I would remove the security flag from this.