Praisonal-platform Vertical Privilege Escalation via PATCH Endpoint (CVE-eligible)

Vulnerability Overview Vulnerability Name: praisonal-platform: Any workspace member can escalate themselves (or any other member) to owner via . Vulnerability Type: Vertical Privilege Escalation Severity: Critical (CVSS v3.1 Score 9.8/10) Description: The vulnerability exists in the endpoint. This endpoint is protected by the guard, which sets the default minimum role to "member" and is not overridden by the route. The handler calls , which sets the target member's role to any role specified in the request body. It does not check if the caller has owner-administrator permissions, nor does it verify if the new role is higher than the caller's current role. The root cause is that has a parameter, but FastAPI's does not pass parameters. Consequently, every route uses the default "member" value. The provided by the URL and the provided by the request body are passed directly to with zero permission checks: it loads the member identified by the composite key and assigns . A user with the lowest possible permission ("member") can escalate their role to "owner" with a single HTTP PATCH request. Scope of Impact Affected Versions: = 0.1.4 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: None Remediation Recommended Fixes: 1. The route must resolve with (or at least ). 2. should reject setting a target role higher than the caller's role to prevent administrators from accidentally elevating other users. Example Code Fix: Exploit Chain 1. The attacker registers an account and joins any workspace as a "member" (the lowest permission level). 2. The attacker sends a request with the authorization header and the request body . 3. executes; its default is satisfied because the attacker is a member. 4. executes, accepts "owner", and returns the attacker's existing member row. The subsequent line mutates the attacker's role in memory. 5. The attacker issues a (or other owner endpoints) and is now recognized as a workspace owner. 6. Final State: Starting from the lowest workspace permission, the attacker becomes a workspace owner with a single HTTP request. The same primitive allows the attacker to degrade a legitimate owner by sending with . Security Impact Severity: Critical (CVSS 9.1) Attack Capability: Any workspace member can become a workspace owner with a single PATCH request. Attacker Capabilities: From adding any user as an owner, changing every workspace setting, to deleting the workspace. Discrepancy: Source check validates end-to-end. The asymmetry lies in the workspace member's parameter (defaulting to "member" and never overridden) and the strict hierarchy of (owner > admin > member > member). Additional Information CVE ID: CVE-2024-47418 Weaknesses: CWE-269, CWE-862 Credits: @tffast, @Ex3n

Goal Reached Thanks to every supporter — we hit 100%!

Praisonal-platform Vertical Privilege Escalation via PATCH Endpoint (CVE-eligible)

More from this source