Authorization Bypass in ZenTao PMS

Executive Summary

ZenTao PMS before version 22.3 has an authorization bypass flaw in the isOpenMethod() function. This allows any logged-in user, even with minimal privileges, to bypass group-based access controls by calling methods containing 'ajax' in their name. The vulnerability affects about 338 out of 360 ajax-prefixed methods across 60+ modules, as most rely solely on the flawed function for permission checks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect ZenTao PMS versions before 22.3 for methods containing 'ajax' in their names that bypass ACL checks. Check the isOpenMethod() function in module/common/model.php for the blanket 'ajax' check. Review logs for unauthorized access to privileged methods like task.ajaxGetByID or system.ajaxDBAuthUrl.

Useful 0 Not Useful 0

Impact Analysis

An attacker with basic access could exploit this to read sensitive data like tasks, documents, or stories without permission. They could obtain database credentials, trigger CI/CD jobs, modify database tables, access webhook secrets, AI tokens, or manipulate kanban cards. The impact ranges from data leaks to full system compromise depending on exposed methods.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR Article 32, HIPAA Security Rule) by enabling unauthorized access to sensitive personal or health data. It undermines access control mechanisms mandated by these regulations, potentially leading to data breaches and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ZenTao PMS to version 22.3 or later to address the vulnerability. If upgrading is not possible, restrict access to methods containing 'ajax' via network controls or WAF rules. Implement additional permission checks for high-sensitivity methods as a temporary measure.

Useful 0 Not Useful 0