Authorization bypass through user-controlled key in Corteza - #VU156189

Vulnerability details

The vulnerability allows a remote user to escalate privileges by acquiring unintended contextual roles and read, create, modify, or delete protected Compose records, depending on the acquired role's grants.

The vulnerability exists due to authorization decisions based on user-controlled profile attributes in Corteza's contextual-role RBAC engine when evaluating role membership expressions. A remote user can send a crafted PUT request to /system/users/{ownID} to change their own email, username, handle, name, or labels to satisfy a contextual-role expression and obtain that role's permissions.

Affected software

Remediation

External References

• https://github.com/cortezaproject/corteza/security/advisories/GHSA-6rpc-jwjp-vh82

Related Security Bulletins

• Multiple vulnerabilities in Corteza