APIv4's EntitySet feature allows execution of multiple sub-requests.
In several cases, the sub-requests execute without meaningful permission checks.
Security Risk
Critical
Vulnerability
Access Bypass
Affected Versions
CiviCRM v6.19.2 and earlier
Fixed Versions
CiviCRM v6.19.3, v6.16.6 (ESR), and later
Publication Date
Solutions
Upgrade to a fixed version of CiviCRM
If you cannot upgrade, then you may wish to block HTTP requests where:
- (1) the path involves
civicrm/ajax/api4, AND... - (2) the phrase
EntitySet(case-insensitive) appears in either the path or GET/POST payload.
Credits
(Alphabetically) Coleman Watts (CiviCRM), Jakub Fidler, Patrick Figel (Greenpeace Central and Eastern Europe), Seamus Lee (JMA Consulting)
