Group search list shows too many results from page 2 onwards

[Andreas Schenkel]

We have multiple isolated institutions in mahara. When we search for a group, then on the first of two pages the results are shown correctly.
Only groups of our institution are visible.
We can see, that there are more results on a second page.

To access the second page there is a link at the bottom. When we click the link, ALL group of all institutions are shown.
mahara 20.10 (since 19.04 up to 20.10)

[Andreas Schenkel (andreas-schenkel)]

click in page 2 shows this group search result

[Andreas Schenkel (andreas-schenkel)]

We will try to fix this bug.

[Andreas Schenkel (andreas-schenkel)]

This patch solves the problem with pagination of grouplists when isolated institutions is activated.
On second page now only the groups of the own institution are shown if the user searches for all groups.
Patch is based on mahara 20.10.4.

[Kristina Hoeppner (kris-hoeppner)]

Hi Andreas and Gold,

Thank you for the patch, Andreas.

Gold, can you please add the patch to Gerrit and see how it works with the ones you have their for isolated institutions?

Thank you
Kristina

[Robert Lyon (robertl-9)]

https://reviews.mahara.org/c/mahara/+/12457

[Kristina Hoeppner (kris-hoeppner)]

For the forum post in the security forum:

Group search page shows too many results when isolated institutions is turned on

Vulnerability type: Insecure permissions
Attack type: Remote
Impact: Information disclosure

Affected components: The group search, accessible via Main menu → Engage → Groups when isolated institutions is turned on for the site.

Attack vectors: If the site turned on isolated institutions and has more than 10 groups on the site, using the paginator on the 'Groups' page, someone can view the title of all groups on the site from page 2 of the results list onwards rather than only seeing groups in their own institution.

Description: Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using 'Isolated institutions' is vulnerable if groups are used. They are all shown from page 2 of the group results list rather than only showing groups for the institution in which the viewer is a member of.

Reported by: Can't disclose
Bug report: https://bugs.launchpad.net/mahara/+bug/1922226
CVE reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29585

[Mahara Bot (dev-mahara)]

Patch for "21.04_DEV" branch: https://reviews.mahara.org/c/mahara/+/12691

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/c/mahara/+/12691
Committed: https://git.mahara.org/mahara/mahara/commit/e058d0c1bc705a5cfc26d55718764599bbe95a3a
Submitter: "Robert Lyon <email address hidden>"
Branch: 21.04_DEV

commit e058d0c1bc705a5cfc26d55718764599bbe95a3a
Author: Andreas Schenkel <email address hidden>
Date: Mon Feb 28 14:18:30 2022 +1300

Security Bug 1922226: Groups search list after first page

For sites with isolated institutions enabled searches for Groups returns
a suitably filtered list of results. After the first page though, all
results are shown regardless of institution.

Change-Id: Ic3809589573ef5a828beaee16fdf729dacfcddf1
Signed-off-by: Gold <email address hidden>
(cherry picked from commit 15bfe15b3c9c0c8beb21b93d363860a985290d29)