GHSA-rw26-wwfc-9wvm ApostropheCMS: Missing Authentication in `cleanExport` Route

• npm @apostrophecms/import-export: < 3.7.1 → fixed in 3.7.1

1. Summary The API endpoint `POST /api/v1/@apostrophecms/import-export/clean-export` in `@apostrophecms/import-export` lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying `self.cleanExport(req)` method. --- 2. Affected Files & Endpoints • Endpoint: `POST /api/v1/@apostrophecms/import-export/clean-export` • Route Definition: `packages/import-export/lib/apiRoutes.js` (lines 32–34) • Method Implementation: `packages/import-export/lib/methods/import.js` (lines 1271–1324) --- 3. Root Cause Analysis In `packages/import-export/lib/apiRoutes.js`, the `get.related` handler explicitly validates that the caller is logged in: ```javascript get: { async related(req) { if (!req.user) { throw self.apos.error('forbidden'); } // ... } } ``` In contrast, `post.cleanExport` (as well as `post.overrideDuplicates`) lacks any verification of `req.user`: ```javascript post: { async overrideDuplicates(req) { return self.overrideDuplicates(req); }, async cleanExport(req) { return self.cleanExport(req); // { get: { ... }, post: { async overrideDuplicates(req) { + if (!req.user) { + throw self.apos.error('forbidden'); + } return self.overrideDuplicates(req); }, async cleanExport(req) { + if (!req.user) { + throw self.apos.error('forbidden'); + } return self.cleanExport(req); } } ```