Oqtane Framework Broken Access Control in Settings

Executive Summary

This is a broken access control vulnerability in Oqtane Framework versions before 10.3.0. An authenticated site administrator can read or modify settings belonging to other sites within the same tenant database by providing an arbitrary entityId for Site or Role type settings. The IsAuthorized and FilterPrivate methods fail to verify if the requested site matches the current alias SiteId, allowing unauthorized access to sensitive data.

Useful 0 Not Useful 0

Detection Guidance

Check Oqtane Framework versions before 10.3.0 by inspecting the installed version in your system or logs. Monitor API requests to /api/setting endpoints for unauthorized access attempts or unusual entityId parameters. Review logs for suspicious modifications to SMTP or OAuth2 settings.

Useful 0 Not Useful 0

Impact Analysis

An attacker with site admin privileges could access or modify confidential settings like SMTP passwords, OAuth client secrets, or authentication configurations for other sites. This could lead to data breaches, unauthorized access to other sites, or disruption of authentication services without needing host-level access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data such as email credentials or authentication secrets, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Oqtane Framework to version 10.3.0 or later. Review and restrict permissions for site administrators to prevent unauthorized access to /api/setting endpoints. Audit and rotate exposed secrets like SMTPPassword or OAuth2 ClientSecrets.

Useful 0 Not Useful 0