Compliance Impact

The vulnerability allows cross-tenant data leakage by associating a ShoppingListEntry with a unit from another tenant's space, which can lead to unauthorized access to foreign-key references across tenant boundaries.

Such unauthorized data exposure and cross-tenant data leakage can negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict data segregation and protection of personal and sensitive information.

Additionally, the unhandled exceptions causing HTTP 500 errors may expose internal server details in debug mode, potentially leaking sensitive information.

Useful 0 Not Useful 0

Executive Summary

The vulnerability in Tandoor Recipes affects the POST /api/food/{id}/shopping/ endpoint in versions prior to 2.6.4. This endpoint reads the 'amount' and 'unit' fields directly from the request data without proper validation or sanitization before creating a ShoppingListEntry.

• The 'amount' field is expected to be numeric, but non-numeric strings cause an unhandled exception leading to an HTTP 500 Internal Server Error.
• The 'unit' field is a foreign key that should be limited to the current tenant's space, but the endpoint does not enforce this, allowing cross-tenant foreign key references and data leakage.

Other endpoints use proper serializers that validate and sanitize these fields, but this specific endpoint lacks such protections. The issue was fixed in version 2.6.4.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways:

• Server Stability: Sending invalid non-numeric 'amount' values can cause unhandled exceptions and HTTP 500 errors, potentially crashing the server or exposing internal details in debug mode.
• Data Confidentiality: The lack of validation on the 'unit' foreign key allows associating shopping list entries with units from other tenants' spaces, leading to unauthorized cross-tenant data leakage.
• Data Integrity: Unauthorized foreign key associations can corrupt data integrity by mixing data across tenant boundaries.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the POST /api/food/{id}/shopping/ endpoint with invalid input values to observe improper handling.

• Send a POST request with a non-numeric string in the amount field (e.g., amount="not_a_number") and check if the server responds with an HTTP 500 Internal Server Error.
• Send a POST request with a unit ID that belongs to a different tenant's space and verify if the request succeeds, indicating cross-tenant foreign key leakage.

Example curl command to test amount validation:

• curl -X POST https://your-tandoor-instance/api/food/123/shopping/ -H "Content-Type: application/json" -d '{"amount": "not_a_number", "unit": 1}'

Example curl command to test unit cross-space leakage:

• curl -X POST https://your-tandoor-instance/api/food/123/shopping/ -H "Content-Type: application/json" -d '{"amount": "1", "unit": 999}'

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include validating and sanitizing input data on the vulnerable endpoint.

• Validate the amount field by converting it to a Decimal and handle exceptions to return a 400 Bad Request on invalid input.
• Filter the unit foreign key by the current tenant's space and return a 400 error if the unit does not belong to the current space.
• Refactor the POST /api/food/{id}/shopping/ endpoint to reuse the ShoppingListEntrySerializer, which properly validates and sanitizes input.

Additionally, upgrade Tandoor Recipes to version 2.6.4 or later where this vulnerability is fixed.

Useful 0 Not Useful 0