redaxo/source: Package API does not check for admin permission

Root cause

The core API function rex_api_package (rex-api-call=package), which installs, uninstalls, activates, deactivates and deletes packages, did not check whether the current user is an administrator. It only required a valid CSRF token for this API function.

Package management is restricted to administrators in the backend: the packages page and all API functions of the install addon check for admin permission. rex_api_package was the only exception.

Impact

A backend user without admin permission who holds a valid CSRF token for rex_api_package can manage all locally available packages, for example:

• uninstall packages, including system addons like structure, whose uninstall routines drop their database tables (e.g. all articles and their content),
• deactivate packages, which can break the backend or the website,
• install or activate packages that are present in the file system but deliberately not installed,
• delete non-system packages from the file system.

Preconditions: the CSRF token is stored in the user's session and is only generated on pages that are restricted to administrators. In practice this means that the user had admin permission in the same session and was demoted afterwards (the session stays valid), or that the token was obtained via another vulnerability. A user who never had admin permission in the session can't obtain a valid token through the regular backend.

Package management is not available in live mode, so installations in live mode are not affected.

Fix

Fixed in 5.21.5: rex_api_package now requires admin permission, like the API functions of the install addon.