Summary
A Broken Function Level Authorization (BFLA) vulnerability in UsersController.php allows users with certain permissions can promote or demote themselves or other users by performing changes to the group’s memberships via API call.
Product
This vulnerability affects snipe-it from v4.6.17 through v6.4.1.
Impact
The vulnerability could be exploited by an unprivileged user to elevate their privileges to superadmin, potentially gaining access to administrative functionality and sensitive information.
Steps to reproduce
Users with the following permissions are allowed to perform group membership changes to groups with higher priviledges:
- Users.edit permission – Determines whether the user has the ability to edit other user’s information.
- Self.api permission – Determines if the user can create personal API keys to utilize the REST API.
With these permissions, users can issue a API call to /users/:id with the PATCH method to modify the associated group memberships.
curl --location --request PATCH 'https://host/api/v1/users/<user_id>' --header 'Content-Type: application/x-www-form-urlencoded' --header 'Authorization: Bearer <token>' --data-urlencode 'groups=<high_priviledged_group_id>'Expected result:
The API request is successful. The user’s group membership is updated to the designated group.
Remediation
A fix was released in commit 34f1ea1 for version v6.4.2, where a new verification has been introduced to check if the user that intends to perform changes has the proper permissions to do so.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Davide Ferreira.
