Privilege Escalation in frab via Unchecked Nested Conference Users

Executive Summary

This is a privilege escalation vulnerability in frab versions up to 0.9.1. Authenticated crew users can exploit unchecked nested conference_users_attributes parameters to grant themselves orga roles. The vulnerability exists in UsersController#update and UsersController#create actions which bypass the filter_conference_users mechanism. Attackers can gain full administrative control over any conference, including managing events, schedules, reviewers, and crew.

Useful 0 Not Useful 0

Detection Guidance

Check frab logs for suspicious UsersController#update or #create actions with nested conference_users_attributes parameters. Look for unauthorized orga role assignments in conference management logs. Review user role changes in the database for anomalies.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of a vulnerable frab instance, an attacker with crew privileges could escalate to orga status. This grants them full control over conferences they do not own, allowing unauthorized access to sensitive data, event management, and scheduling. The impact depends on whether you host conferences on a vulnerable system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized privilege escalation to orga roles, granting full control over conference data, events, schedules, and crew management. Such unauthorized access could lead to unauthorized data exposure, modification, or deletion, violating GDPR's data integrity and confidentiality requirements and HIPAA's access control and audit safeguards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade frab to a patched version (post commit 8d14d49). Apply the filter_conference_users fix to restrict orga role assignments. Audit all user roles and revoke unauthorized orga privileges. Monitor UsersController actions for suspicious activity.

Useful 0 Not Useful 0