Missing Authorization in Metasfresh Allows Record Access Bypass

Executive Summary

This vulnerability in metasfresh through version 5.175 allows authenticated low-privilege users to bypass role and organization access checks. Attackers can exploit this by calling specific handlers like getBoard, getCard, addCard, removeCard, and patchCard to read records outside their permitted scope and modify board card assignments.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves missing record-level authorization in metasfresh's BoardRestController. To detect it, inspect network traffic for requests to endpoints like /rest/board/getBoard, /rest/board/getCard, /rest/board/addCard, /rest/board/removeCard, or /rest/board/patchCard. Check if low-privilege users can access or modify records outside their assigned roles or organizations. Monitor for unusual modifications to board card assignments.

Useful 0 Not Useful 0

Impact Analysis

Unauthorized users may access sensitive data or modify board configurations they should not have permission to view or change. This could lead to data leaks, incorrect record updates, or unauthorized system modifications, depending on the attacker's goals.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows low-privilege users to read records outside their scope and modify board card assignments, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by exposing protected information to unauthorized individuals.

Useful 0 Not Useful 0

Mitigation Strategies

Update metasfresh to the latest version beyond 5.175 to address the missing authorization checks. Review and restrict access to BoardRestController endpoints for low-privilege users. Monitor logs for unauthorized calls to getBoard, getCard, addCard, removeCard, or patchCard handlers.

Useful 0 Not Useful 0