Privilege Escalation in Map-OS via REST Users API

Executive Summary

This vulnerability is a privilege escalation flaw in Map-OS versions 5.0.0 to before 5.2.2. It allows non-administrator users with the cUsuario permission to bypass permission controls and perform actions reserved for higher-privileged users. Attackers can send requests to /api/v1/usuarios to assign admin rights, reset super admin passwords, or delete privileged users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for POST, PUT, or DELETE requests to /api/v1/usuarios from non-administrator users. Check Map-OS logs for unauthorized attempts to assign the Administrador group, reset super administrator passwords, or delete higher-privileged users.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to gain administrative access, reset critical passwords, or delete important accounts. This could lead to complete system compromise, data loss, or unauthorized system control. Systems with API enabled are at risk; those with API disabled are unaffected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's access control requirements. Unrestricted privilege escalation may result in unauthorized disclosure or modification of personal health or user data, triggering compliance breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Map-OS to version 5.2.2 or later. If upgrading is not possible, disable the API by setting API_ENABLED=false in configuration. Review user permissions and audit logs for suspicious activity.

Useful 0 Not Useful 0