Traccar Broken Access Control: Unauthorized Device Media Write via POST /devices/{id}/image

Vulnerability Overview Vulnerability Name: traccar_001 Vulnerability Report Vulnerability Type: Broken Access Control Vulnerability Description: In the traccar project, there is a broken access control vulnerability. An attacker can bypass normal permission checks by crafting specific requests, allowing unauthorized write operations to device files. Impact Scope Affected Versions: - b7b0e1383b46a1ab30fc7ca - 6.13.0 - dbd44deac90b0fb Trigger Scenario: When using a normal shared device token to create a temporary read-only user, it is possible to write to via a POST request to , even if the identity is rejected by the normal device edit path. Remediation Plan 1. Add before writing the uploaded file. 2. Maintain an explicit device permission check on the target object before writing the path, consistent with other modification handlers. 3. Add regression tests for temporary shared users, , and conditions to counter . 4. Audit other auxiliary write endpoints that rely on without matching edit checks. POC Code Risk This vulnerability breaks the intended boundary between read-only access and device modification. A user who should only observe devices can still kill persistent device media through normal REST endpoints. Impact An unauthorized user can replace device-stored image files located in the server's media directory. This allows modification of UI-visible device media and any downstream workflows that depend on persistent images, even though other device update paths correctly reject the same identity. Exploitation Prerequisites 1. The attacker has any authenticated account or shared device token granting access to the target device. 2. The user is assumed to be read-only, as or should block device modifications. 3. Media storage is enabled, so device images are persisted to disk. Root Cause authorizes the target device only through . This route does not call , unlike and the explicit device mutation handler . The skipped step is precisely where Traccar enforces and restrictions for non-admin users. Source-to-Sink Chain 1. Source: - creates a temporary shared device user with and returns a normal token for that identity. - and accept the token and bind the temporary shared user to the request. 2. Propagation: - accepts the attacker-controlled , request body, and content type, loading the device using only and deriving plus the output extension. - shows the expected edit path for mutation endpoints, but omits this check. - contains the skipped / enforcement that would otherwise throw . 3. Sink: - forwards the uploaded body to . - resolves the path to and opens a , resulting in unauthorized file writing. Summary This vulnerability allows an unauthorized user to bypass normal permission checks and perform unauthorized write operations on device files by crafting specific requests. The remediation plan includes adding permission checks before writing uploaded files, maintaining explicit device permission checks on target objects, adding regression tests, and auditing other auxiliary write endpoints.

Goal Reached Thanks to every supporter — we hit 100%!

Traccar Broken Access Control: Unauthorized Device Media Write via POST /devices/{id}/image

More from this source