Zipline TOCTOU Race Condition Leading to Superadmin Account Creation

Executive Summary

Zipline before version 4.6.5 has a TOCTOU race condition in the POST /api/setup endpoint. This allows unauthenticated attackers to create multiple SUPERADMIN accounts by sending concurrent requests before the firstSetup flag is reset. Attackers can spoof X-Forwarded-For headers during the argon2 hashing window to bypass rate limits and gain full administrative control.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for multiple SUPERADMIN account creations in a short timeframe, especially during initial setup. Check logs for concurrent POST /api/setup requests with spoofed X-Forwarded-For headers. Look for rapid database changes indicating non-atomic operations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full administrative access to your Zipline instance without authentication. This could lead to data theft, unauthorized modifications, or complete system compromise. All fresh installations of Zipline 4.6.4 or earlier are affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information. Full administrative access may result in non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Zipline to version 4.6.5 or later. If upgrading is not possible, disable the POST /api/setup endpoint until patched. Implement network-level restrictions to block unauthenticated access to setup endpoints. Review logs for signs of exploitation.

Useful 0 Not Useful 0