Security: Unauthenticated ticket creation endpoints + REST API bypasses custom access control

[lighthousekeeper1212]

Summary

Security audit found 4 vulnerabilities (1 CRITICAL, 2 HIGH, 1 MEDIUM) in this Drupal 7-based helpdesk system.

1. CRITICAL: Unauthenticated Incoming Mail Endpoints (CWE-306)

File: sites/all/modules/incoming_mail/incoming_mail.module lines 8-21

Both tickets/incoming/new and tickets/incoming/reply use 'access callback' => 1 (always TRUE). Anyone can POST to create tickets as any email address. The system auto-creates Drupal user accounts for unknown emails.

Fix: Add webhook authentication (HMAC signature verification or API key).

2. HIGH: REST API Bypasses Custom Comment Access (CWE-863)

File: sites/all/modules/helpdesk/helpdesk.module lines 116-137 vs services/resources/comment_resource.inc lines 387-421

The helpdesk module's helpdesk_comment_access() restricts ticket comments to owner/agent/admin. But the REST API's _comment_resource_access() only checks generic user_access('access comments'), bypassing the custom restriction. Any authenticated user can read all ticket comments via REST API.

Fix: Apply helpdesk_comment_access() check in the REST API resource access callbacks.

3. HIGH: REST API Node Create Allows UID Impersonation (CWE-639)

File: helpdesk.module lines 589-607

helpdesk_rest_server_request_parsed_alter() accepts a customer.email field and sets $data['uid'] to the corresponding user, enabling ticket creation as any other user.

Fix: Validate the requesting user has permission to create tickets on behalf of the specified email.

4. MEDIUM: Weak Security Token Comparison (CWE-208)

Anonymous ticket access uses PHP == for token comparison instead of hash_equals(), vulnerable to timing attacks.

Fix: Use hash_equals() for constant-time comparison.