GrowChief Missing Authorization in User Enumeration

Executive Summary

GrowChief through 0.3.0 has a missing authorization vulnerability in the getAllUsers handler. The /users/all-users endpoint lacks the IsSuperAdmin guard, allowing any authenticated user to list users across all organizations. Attackers with a low-privilege account can send an empty search value to enumerate user IDs, emails, names, and organization IDs for every tenant.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the /users/all-users endpoint is accessible without proper authorization. Send a GET request with an empty search parameter to see if it returns user data across all organizations. Example using curl: curl -H 'Cookie: auth=YOUR_TOKEN' 'http://TARGET/users/all-users?search='

If the response includes user IDs, emails, names, or organization IDs from multiple tenants, the vulnerability is present. Ensure the endpoint is restricted to super-admins only.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to enumerate sensitive user data across all tenants, including emails, names, and organization IDs. This could lead to cross-tenant confidentiality breaches, privilege boundary bypass, and potential targeted phishing campaigns using exposed information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's data minimization and security principles by exposing excessive user data across tenants. It may also conflict with HIPAA's access control and integrity requirements, as unauthorized access to user information across organizations breaches compliance standards.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the @UseGuards(IsSuperAdmin) decorator to the /users/all-users endpoint to restrict access to super-admins only. Update to the latest patched version if available.

Implement input validation to reject empty or overly broad search queries. Review and restrict other endpoints for similar authorization gaps.

Useful 0 Not Useful 0