Snipe-IT: Authorization bypass via hardware update endpoint, CWE-862

Vulnerability Key Information Summary Vulnerability Overview Title: Bypass of Checkout Authorization and Custody Workflow via Asset Update Endpoint Type: Authorization Bypass / Workflow Bypass CVSS 3.1: 6.5 / 10 (Medium) CWE: - CWE-862: Missing Authorization - CWE-641: Improper Enhancement of Behavioral Workflow Affected Versions: < 8.6.3 Fixed Version: 8.7.0 Affected Endpoint: Impact Scope Product: Snipe-IT Affected Version: v8.6.3 (build 22252-9ffcf2a3a) Affected Commit: 9ffcf2a3a Deployment Method: Self-hosted instance Business Severity: High Recommended CVSS 3.1: 6.5 Medium Vulnerability Description Snipe-IT defines separate permissions for asset editing and asset checkout: Invoking the dedicated checkout endpoint returns ("This action is unauthorized.") However, the same account successfully performed a checkout operation via (returning 200) and modified the field. POC / Exploit Code 1. Test Account Permissions (Note: The original text indicates "explicitly denied" in the overview, but the JSON shows . Based on the context of a bypass, the permission likely should have been 0/denied for the test account. The translation preserves the source text exactly as provided in the JSON block.) 2. Setting Required Variables 3. Verify Test Identity and Permissions 4. Negative Control: Using the Dedicated Checkout Endpoint Observation: 5. Executing Checkout via the Update Endpoint Observation: 6. Custody Workflow Bypass The asset was legitimately checked out to User 1: The edit-only account subsequently submitted: Final state: The custodian changed from User 1 to User 3, but the check-in counter and last_checkin timestamp remained unchanged. 7. Audit Trail The asset history includes two consecutive checkout events: No check-in record exists in between. The unauthorized operation is recorded as: 8. Additional State Bypass The same endpoint also allows the edit-only account to set the asset status to Pending: The normal checkout process would reject this asset because it is not deployable. Expected Behavior When assignment fields are submitted via the asset update endpoint, the application should: 1. Reject these fields and enforce the use of the dedicated checkout endpoint; or 2. Explicitly enforce the authorization, availability, transactional, and audit requirements for checkout within the update method. An account with explicitly denied should not be able to create a checkout or change the asset's custody status. Impact Edit-only users can: Check out any visible asset Transfer an asset from a legitimate custodian to another user Bypass check-in and reverse workflows Assign assets in non-deployable states Alter checkout counters and timestamps Generate misleading checkout history Weaken the separation of duties between asset editing and custody operations Disrupt the authorization record registry and custody audit trail As an asset registry and custody system, the affected fields in Snipe-IT carry security and accountability records, not accidental metadata. Potential Consequences: Employee accountability Asset loss investigations Inventory reconciliation Financial and compliance reporting Internal approval and asset handling processes Root Cause The asset update endpoint treats assignment fields as part of a generic update operation. Vulnerability Sequence: 1. The request is authorized using the asset update capability 2. The update capability is authorized as 3. Assignment fields are accepted by the update request 4. The target user, asset, or location is resolved 5. The checkout method is invoked 6. A separate checkout authorization check is not performed 7. validation is not performed 8. Existing assignments can be overwritten without a check-in Fix Fixed Version: 8.7.0 Fix Commit: Key Fix Points: In the asset update endpoint, when assignment fields are submitted, the authorization check should be explicitly enforced, or modification of custody-related fields via the update endpoint should be rejected, enforcing the use of the dedicated checkout endpoint.

Goal Reached Thanks to every supporter — we hit 100%!

Snipe-IT: Authorization bypass via hardware update endpoint, CWE-862

More from this source