Nuclio IDOR on project write paths: authed users can modify/delete any project

Vulnerability Overview Vulnerability Name: Missing authorization on project write paths allows any authenticated user to modify or delete any project Vulnerability Type: Privilege escalation for authenticated users (IDOR / Missing Authorization Check) Root Cause: The project write paths ( , ) lack identity- or ownership-based authorization checks, allowing any user holding valid Nuclio Dashboard credentials to modify or delete any project. Scope of Impact Affected Versions: Nuclio 1.15.26 (Helm release) and HEAD commit (source code) Impact: - Any authenticated user can modify the configuration of any project ( ) - Any authenticated user can delete any project ( ) - Delete operations cascade to delete all associated Functions and FunctionGroups Attacker Model: Authenticated users who hold valid Nuclio Dashboard credentials but lack OPA permissions for the target project (low-privilege/no-permission users) Remediation Add identity- or ownership-based authorization checks to the project write paths ( / ) (e.g., verify that includes the current user, or invoke OPA policy checks) Refer to the correct implementation in the read paths (where performs format validation + OPA validation via ) Add OPA authorization calls in / within , avoiding reliance on format validation alone POC / Exploit Code Mock OPA Server ( ) Nuclio Dashboard Start Command ```bash ./nuclio-v0.001-test/nuclio-dashboard \ --listen-addr=8070 \ --auth-config-kind=OPA \ --auth-config-authorization-url="http://127.0.0.1:9999/verify" \ --auth-config-authorization-method="GET" \ --auth-config-authorization-header="Authorization" \ --auth-config-authorization-token="admin-token" \ --auth-config-authorization-cache-expiration-timeout=09s \ --auth-config-authorization-cache-size=100 \ --auth-config-authorization-filter-url="http://127.0.0.1:9999/filter_allowed" \ --namespace="test" \ --module-logger-demonstrator \ --module-logger-demonstrator \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --log-level=info \ --

Goal Reached Thanks to every supporter — we hit 100%!

Nuclio IDOR on project write paths: authed users can modify/delete any project

More from this source