Authorization Bypass in Faveo Helpdesk Ticket System

Executive Summary

This vulnerability is an authorization bypass in Faveo Helpdesk through version 2.0.3. Authenticated agents can modify tickets outside their department by referencing raw ticket IDs. Attackers can exploit endpoints like merge-tickets, change-owner, ticket/assign, and ticket/surrender to close, merge, or reassign tickets belonging to other departments. It also allows enumeration of customers' ticket subjects.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized ticket modifications by reviewing logs for endpoints like merge-tickets, change-owner, ticket/assign, and ticket/surrender. Look for requests referencing raw ticket IDs outside the agent's department. Use network monitoring tools to inspect HTTP requests to these endpoints for suspicious activity.

Useful 0 Not Useful 0

Impact Analysis

An attacker with agent access could tamper with tickets not assigned to their department, leading to unauthorized changes in ticket status, ownership, or content. This could disrupt support operations, expose sensitive ticket information, or allow attackers to manipulate ticket data for malicious purposes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive customer data in tickets, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Compliance may be compromised if unauthorized changes occur to ticket records containing regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Faveo Helpdesk version 2.0.4.RC.1 or later, which includes fixes for improper authorization checks. If upgrading is not immediately possible, restrict access to sensitive ticket endpoints and implement strict input validation for ticket IDs.

Useful 0 Not Useful 0