Authentication Bypass in Padloc SCIM Directory Access

Executive Summary

This vulnerability in Padloc through version 4.3.0 allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization ID can query the Users and Groups SCIM endpoints to retrieve sensitive information such as usernames, emails, names, external IDs, and group memberships.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Padloc server version is 4.3.0 or earlier. Test the SCIM endpoints by sending a GET request with a non-empty bearer token to /Users or /Groups endpoints. If the server returns user or group data without proper authentication, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain access to sensitive user data like emails and group memberships, potentially leading to further attacks such as phishing, privilege escalation, or unauthorized access to protected resources within the organization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using affected versions may face compliance violations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Padloc to the latest version where the SCIM token validation fix has been applied.
• Ensure all SCIM endpoints enforce strict token validation using timing-safe comparisons.
• Review and remove any unauthorized user accounts or group memberships that may have been created due to this vulnerability.

Useful 0 Not Useful 0