GHSA-FM29-4MQ3-PHG6: Missing Authorization in Winter CMS ImportExportController Behavior

The vulnerability designated as GHSA-FM29-4MQ3-PHG6 identifies an authorization bypass within Winter CMS, specifically affecting the ImportExportController behavior located in modules/backend/behaviors/ImportExportController.php.

This behavior is designed as a horizontal code-reuse mixin that allows developers to quickly equip custom backend controllers with comprehensive CSV or Excel import and export capabilities.

The attack surface exists for authenticated backend users who possess permissions to access a parent controller but are explicitly restricted from performing data imports or exports through granular permissions.

Due to an execution-order mismatch in the request lifecycle, the granular security barriers designated for import and export functions were not enforced during direct AJAX-based requests, enabling privilege escalation (CWE-862).

To understand the core flaw, it is necessary to examine the request-handling lifecycle of the Winter CMS backend controller class (Backend\Classes\Controller).

During controller initialization, any declared behaviors, such as ImportExportController, are instantiated, which automatically binds their respective widgets and AJAX handlers to the parent controller instance.

When a request arrives as an AJAX POST, the framework executes Backend\Classes\Controller::execAjaxHandlers() early in the execution sequence.

If the handler name matches an endpoint declared by the behavior (such as onImport or onExport), that handler runs immediately, outputs its response, and early-terminates the execution flow.

Consequently, the execution path never reaches the controller's execPageAction() method, which is the only phase where the security checkpoints in import() and export() were evaluated.

The execution flow mismatch is illustrated in the sequence diagram below, which shows how direct AJAX requests completely bypass the traditional page action security barriers:

Prior to the fix implemented in version 1.2.14, the behavior restricted access exclusively within the page view methods. This meant that the security policy was completely bypassed when interacting directly with the underlying AJAX handlers.

// Vulnerable execution path in ImportExportController.php
public function import()
{
    if (!$this->userHasAccess('import')) {
        abort(403); // Check was only present here!
    }
    // ... standard action logic ...
}

The official patch modified the behavior to inject authorization checks directly inside each internal handler and the download action. This modification blocks unauthorized operations during the initial state-binding process.

// Patched execution path in ImportExportController.php
public function onImport()
{
    if (!$this->userHasAccess('import')) {
        abort(403); // Added explicit handler gate
    }
    try {
        $model = $this->importGetModel();
        // ... model import logic ...
    }
    // ... error handling ...
}

This remediation ensures completeness because the authorization check is now executed immediately upon entering any entry point that manipulates state or retrieves generated documents.

An attacker seeking to exploit this vulnerability must first obtain valid authenticated credentials for the Winter CMS backend. The user account must have permissions to access the parent controller but be denied the specific import/export administrative actions.

To bypass the standard interface restriction, the attacker bypasses the HTML form and makes a direct POST request to the controller's endpoint, declaring the targeted AJAX handler in the headers.

POST /backend/acme/records HTTP/1.1
Host: target.local
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
X-OCTOBER-REQUEST-HANDLER: onExport
 
export_columns[]=id&export_columns[]=email&visible_columns[id]=1&visible_columns[email]=1

The server executes the query and generates the CSV file, returning a download payload with a temporary identifier. The attacker then fetches the file directly via the unguarded download path, retrieving sensitive database tables without authorization.

The vulnerability introduces severe risks to confidentiality and integrity. Since the import and export utilities handle raw database interactions, bypassing their gates allows full data exfiltration and database tampering.

An attacker can export customer lists, configuration credentials, or proprietary datasets. Additionally, by invoking the import action, the attacker can alter database values, escalate privileges of administrative accounts, or insert malicious entries.

A CVSS v3.1 base score of 8.1 reflects the impact when exploited by a low-privileged user. The attack vector is entirely remote, requires minimal complexity, and bypasses local logical partitioning.

The primary remediation strategy is upgrading the Winter CMS installation to version 1.2.14 or later. This can be achieved through composer by running the update command.

If upgrading immediately is not possible, security teams should apply the code patch manually to modules/backend/behaviors/ImportExportController.php using the commit modifications.

As a temporary workaround, network administrators can deploy Web Application Firewall (WAF) rules to inspect incoming requests. Specifically, log and block any POST requests to /backend routes that contain the request handler header value onExport or onImport if the authenticated user lacks matching privileges.