Backpack CRUD GHSA-xp2z-hrfc-hw62: Unverified Password Update via Mass Assignment

Vulnerability Summary: Unvalidated Password Change in MyAccountController (GHSA-xp2z-hrfc-hw62) Vulnerability Overview Type: Unvalidated password change (Mass Assignment / Attribute Assignment Vulnerability) Location: action (bound to ) Root Cause: The controller calls , writing all fields from the request body, except , directly into the user model. Since fields such as , , , and are mass-assignable in the user model, an attacker can include a field in a POST request, bypassing the validation logic of and directly modifying the password. Severity: High (CVSS 7.6 / 10) Affected Versions: 6.8.11 to < 7.0.34 (Fixed in: 7.0.34) Scope of Impact 1. Persistent Account Takeover After Session Hijacking: An attacker holding any authenticated Backpack session cookie (via XSS, stolen devices, or shared workspaces) can modify fields such as , , and , bypassing the password change validation flow. 2. Email Field for Full Takeover: The attacker can modify the field, and in combination with fields like , achieve full account takeover. 3. Mass Assignment of Other Attributes: In real-world deployments, the admin user model may carry fields such as , , , , and . These fields can be modified in bulk within the same request, extending the impact to privilege escalation and disabling of 2FA. Fix Replace with an explicit whitelist, consistent with : Key Code (POC / Vulnerable Code) Vulnerable Code ( ): Fixed Code: Coordinate Information Repository: Vulnerable File: (release 6.8.10, master @201c5) Route: (default admin configuration: ) Validation Targets: 6.8.10, 11.x, PHP 8.4.7 Reporter: therave (responsible disclosure)

Goal Reached Thanks to every supporter — we hit 100%!

Backpack CRUD GHSA-xp2z-hrfc-hw62: Unverified Password Update via Mass Assignment

More from this source