Broken Object Level Authorization in Krayin CRM

Executive Summary

Krayin CRM before version 2.2.7 has a broken object level authorization flaw in the EmailController. This allows authenticated users with limited scope to manipulate emails belonging to other users by using their numeric IDs. Attackers can exploit update, destroy, mass-update or mass-destroy endpoints to edit, resend, trash or permanently delete emails. They can also access email subject, body and linked lead and person data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API calls to the EmailController endpoints for unauthorized access patterns. Check for requests with numeric email IDs not belonging to the authenticated user, especially for update, destroy, mass-update, or mass-destroy actions. Review logs for is_draft=0 modifications or unexpected email deletions.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of Krayin CRM before 2.2.7, an attacker with access to your account could view, modify or delete emails sent or received by other users. They could also access sensitive email content and associated lead or person data, potentially leading to data breaches or unauthorized information disclosure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of personal data, violating GDPR principles of data protection and user rights. For HIPAA, it risks exposing protected health information if emails contain such data, leading to compliance failures and potential penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Krayin CRM to version 2.2.7 or later to patch the broken object level authorization vulnerability in EmailController write actions.

Useful 0 Not Useful 0