Security: Multiple Critical Vulnerabilities (Unauthenticated Webhooks, REST API Access Bypass, User Impersonation)

[lighthousekeeper1212]

Summary

A security audit identified 7 vulnerabilities (3 Critical, 2 High, 2 Medium) in the Deskulu helpdesk system.

Critical Findings

1. Unauthenticated Ticket/User Creation via Incoming Mail Webhooks

File: sites/all/modules/incoming_mail/incoming_mail.module, lines 8-21

Both tickets/incoming/new and tickets/incoming/reply have 'access callback' => 1 (always accessible). These Mandrill webhook endpoints perform ZERO verification of the webhook source — no signature validation, no IP allowlist, no shared secret.

An attacker can forge webhook requests to create arbitrary tickets, auto-create Drupal user accounts for any email, and upload arbitrary files.

2. REST API Comment Access Bypass (IDOR)

File: sites/all/modules/helpdesk/helpdesk.module vs sites/all/modules/services/resources/comment_resource.inc

The helpdesk module restricts ticket comment viewing to ticket owners and agents via helpdesk_comment_access(), but this only overrides the Drupal web route (comment/%). The Services REST API uses its own _comment_resource_access() which only checks user_access('access comments') — any authenticated user can read ALL ticket comments via the API.

3. REST API Ticket Creation Allows User Impersonation

File: sites/all/modules/helpdesk/helpdesk.module, lines 589-607

When creating tickets via the REST API with a customer.email field, the function auto-creates a Drupal user for that email and sets $data['uid'] to that user — allowing ticket attribution to any email address and arbitrary user account creation.

High Findings

4. Weak Security Token Generation

File: incoming_mail.module, lines 189-197 — Uses PHP's non-cryptographic rand() for security tokens that gate anonymous ticket access and email reply authentication.

5. SQL Injection via Services Module orderby Parameter

File: services.module, lines 943-946 — The orderby column name is not sanitized in $query->orderBy($column, $sort), affecting all index endpoints (node, user, comment, file).

Recommended Fixes

1. Add webhook signature verification for Mandrill (X-Mandrill-Signature header)
2. Apply helpdesk access checks to the REST API comment endpoints (override _comment_resource_access)
3. Validate/restrict customer email in REST API ticket creation
4. Replace rand() with random_bytes() or openssl_random_pseudo_bytes() for token generation
5. Sanitize orderby parameters against a whitelist of allowed column names

---

Reported responsibly to help improve application security.