OpenReception CVE-2024-4805 Unauthenticated Global Admin Account Creation

Vulnerability Overview Vulnerability Name: Unauthenticated GLOBAL_ADMIN account creation post-bootstrap Vulnerability Description: A fully configured OpenReception instance accepts unauthenticated POST requests to and creates additional GLOBAL_ADMIN accounts without verifying whether an administrator already exists. Any unauthenticated network attacker can submit a same-origin POST request to gain full platform-level administrative privileges. The newly created account has , , and does not require email confirmation. The global GLOBAL_ADMIN role is created and immediately activated, requiring no further interaction. Login and tenant enumeration succeed without any interaction. Impact Scope CVSS v3 base metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2024-4805 CWE-862: Missing Authorization Remediation Recommended Fix: - Call (or an equivalent atomic check) at the beginning of the form action handler. If an administrator already exists, return a 403/404 response. - The check must occur within the action logic, not just based on the payload. - A single concurrent declaration during legitimate bootstrapping should be protected by database-level constraints rather than relying on read-after-write checks. POC Code Database State Before exploit: After exploit: Post-Login Steps The response sets an cookie containing a JWT with . Using this cookie to GET returns the complete tenant list. Expected vs. Actual Behavior Expected: When at least one GLOBAL_ADMIN exists, the form action should return an error or redirect, and no new administrator row should be created. Actual: A new GLOBAL_ADMIN row is created and immediately activated, without requiring email confirmation. The account persists even if the response is delayed or the client disconnects. Impact A single network attacker can take full control of platform administrative privileges with a single request. The attacker can read and edit any tenant, create or delete tenants, modify or delete employee users, and modify tenant configurations. Patient appointment information is protected by the E2E model and is not exposed by this finding, although it may be exposed alongside the employee encryption poisoning issue (V-4). For commercially hosted OpenReception platforms, tenant configurations and user/employee records for each client can be accessed via a single attack. For self-hosted medical practices, the impact is local but equally severe due to the context of patient data. Affected Code Verification Methodology The finding was verified against the official stack from the OpenReception repository. The stack includes Caddy as a reverse proxy with TLS termination, the application image running , and PostgreSQL with secret-based authentication. The Caddyfile was modified to use only Caddy's for self-signed certificates. The layout-level guard protects the setup page by redirecting only on GET requests, while the form action handler allows users without re-checking . Three GLOBAL_ADMIN accounts were created sequentially during testing, with no throttling observed. Auditing specific event logs was not achieved at standard application log levels; standard lines appear only when uniqueness conflicts occur. Form POSTs are rejected by browser-driven CSRF protection via SvelteKit's built-in origin checks, but any tool providing a matching header (curl, Burp, automated scanners, server-side proxies) can easily bypass this. No prerequisites exist.

Goal Reached Thanks to every supporter — we hit 100%!

OpenReception CVE-2024-4805 Unauthenticated Global Admin Account Creation

More from this source