SB2023052002 - Multiple vulnerabilities in Zulip Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023052002

SB2023052002 - Multiple vulnerabilities in Zulip Server

Published: May 20, 2023

Security Bulletin ID SB2023052002
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper Privilege Management (CVE-ID: CVE-2023-32677)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to improper privilege management when sending invitations. A remote user can add other users to streams when they are not authorized to do so.


2) Improper authorization (CVE-ID: CVE-2023-28623)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to an error in the registration process. A remote attacker can register a new account in the organization with an arbitrary email address in their control that's not in the organization's LDAP directory.

Successful exploitation of the vulnerability requires that ZulipLDAPAuthBackend and an external authentication backend (any aside of ZulipLDAPAuthBackend and EmailAuthBackend) are the only ones enabled in AUTHENTICATION_BACKENDS in /etc/zulip/settings.py and that the organization permissions don't require invitations to join.


Remediation

Install update from vendor's website.

References