Analysis of API Key Privilege Escalation and Webhook SSRF in PHP Framework

Vulnerability Overview This vulnerability involves the abuse of API key permissions, specifically manifested as: 1. Persistence of API Key Permissions: API keys were created without considering their permission scope. Consequently, even if permissions are revoked, the keys may still retain full access rights. 2. Insufficient Protection for Super Admin Targets: Operations targeting super admin accounts (such as creating API keys, deleting keys, generating 2FA, and disabling 2FA) are insufficiently protected. This allows non-super-admin users to execute these actions using API keys. 3. Incomplete Webhook URL Validation: Webhook URLs are only validated using but do not restrict protocols via . This allows access to private or link-local addresses (including cloud metadata), and responses can be intercepted by man-in-the-middle attackers. Impact Scope API Key Permissions: Any user possessing an API key may retain full access rights even if their permissions have been revoked. Super Admin Targets: Non-super-admin users can perform super admin operations via API keys, such as creating API keys, deleting keys, generating 2FA, and disabling 2FA. Webhook URLs: Webhook URLs can be set to private or link-local addresses, leading to sensitive information leakage. Remediation Measures 1. API Key Permissions: - Pass the API key's permission scope to during authentication to ensure the scope is checked with every request. - Use the method to restrict the permission scope of API keys. 2. Protection for Super Admin Targets: - Add a method in to ensure that only super admins can perform operations on super admin targets. - Invoke the method in and to protect relevant operations. 3. Webhook URL Validation: - Add a method in to verify that the Webhook URL uses the HTTP or HTTPS protocol and to exclude private or link-local addresses. - Set to in to ensure Webhook requests are sent only via HTTPS. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Analysis of API Key Privilege Escalation and Webhook SSRF in PHP Framework

More from this source