DoraCMS Mass Assignment Vulnerability Allows Account Takeover

Executive Summary

DoraCMS through 3.1.0 has a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint. Authenticated low-privileged users can rebind their API key to another user's account by setting the userId field on their own key to a victim's id. This allows attackers to impersonate the victim and modify profiles or publish/delete content.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check DoraCMS API logs for PUT requests to /api/v1/user/api-keys/:id where the request body includes a userId field. Unauthorized userId modifications in logs indicate exploitation. Use curl to test the endpoint: curl -X PUT -H 'Authorization: Bearer YOUR_KEY' -H 'Content-Type: application/json' -d '{"userId":"VICTIM_ID"}' http://TARGET/api/v1/user/api-keys/YOUR_KEY_ID. If the response shows the API key is now bound to VICTIM_ID, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to another user's account, modify their profile, or publish or delete content as if they were that user. This could lead to data theft, reputational damage, or disruption of services if the victim is an administrator or content publisher.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using DoraCMS may face compliance breaches, legal penalties, and loss of trust due to potential data exposure or unauthorized modifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update DoraCMS to the latest version beyond 3.1.0 to patch the mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint. Ensure all users with API key access are reviewed and unauthorized bindings are removed.

Useful 0 Not Useful 0