CVE Request: Joomla! FLEXIcontent - Incorrect Authorization (Authorization Bypass)

[Seth Art <sart () openskycorp com>]

-----------
Vendor:
-----------
FLEXIcontent (http://www.flexicontent.org) is an advanced content management system developed to greatly enhance the 
native content management of Joomla!

-----------------------------------------
Affected Products/Versions:
-----------------------------------------
flexicontent-cck-3.0.13
flexicontent-cck-3.1.0-rc
Note: Previous versions may be affected

-----------------
Description:
-----------------
Title: Joomla! FLEXIcontent - Incorrect Authorization (Authorization Bypass)
CWE-863: Incorrect Authorization (https://cwe.mitre.org/data/definitions/863.html)
Detailed write-up: http://www.openskycorp.com/resource-center/blog/joomla-flexicontent-incorrect-authorization/
Researcher: Seth Art

CWE-863 Description: "The software performs an authorization check when an actor attempts to access a resource or 
perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access 
restrictions."

The FLEXIcontent plugin uses a query string parameter, task, which specifies the action to perform on a FLEXIcontent 
article.  If an unauthenticated actor provides any value other than edit or a blank value to the task parameter, the 
actor is able to view the restricted FLEXIcontent article, regardless of the assigned permissions.  Articles are 
sequentially numbered, which would allow an actor exploiting this vulnerability to gain read-only access to all 
FLEXIcontent articles by iterating through article identifiers.

---------------
POC:
---------------
http://host/index.php/content_page/#/#?task=abcd
http://host/index.php/content_page/2/6?task=foo
http://host/index.php/content_page/2/7?task=foo
http://host/index.php?option=com_flexicontent&view=item&id=#&task=abcd (if Search Engine Friendly URLs are disabled)

-------------
Solution:
-------------
Upgrade to flexicontent-cck-3.1.1 or greater

-----------------------------
Disclosure Timeline:
-----------------------------
2016-09-28: Notified FLEXIcontent author of vulnerability.
2016-09-28: FLEXIcontent author acknowledges vulnerability and confirms it will be fixed.
2016-10-31: FLEXIcontent v3.1.1 is released and silently fixes vulnerability.
2016-11-30: Researcher tests v3.1.1 and determines vulnerability has been fixed.
2016-01-31: Researcher asks the author to mention the security issue in release notes (no response).
2017-03-06: Public disclosure