Executive Summary

This vulnerability exists in the AGL app-framework-binder (afb-daemon) up to version 19.90.0 and involves a privilege escalation issue in the supervision Do command.

Specifically, the function on_supervision_call nullifies the request credentials before dispatching an API call controlled by the attacker. This means the credentials are set to NULL before the target API executes.

Because the attacker controls the API and verb parameters via JSON input, they can execute any registered API with a NULL credential context.

If the APIs rely on the credentials in the context for authorization, they may fail open when receiving NULL credentials, allowing the attacker to escalate privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with limited privileges to escalate their privileges by executing API calls without proper authorization checks.

Because the credentials are nullified before the API call, APIs that depend on these credentials for security may inadvertently grant higher access or perform sensitive actions.

The impact includes potential unauthorized access to sensitive data, modification of system settings, or disruption of services, as indicated by the high CVSS score (7.8) with high impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows privilege escalation by enabling attacker-controlled API calls with NULL credential contexts, potentially bypassing authorization checks. This could lead to unauthorized access to sensitive data or system functions.

Such unauthorized access and privilege escalation may result in violations of common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.

Useful 0 Not Useful 0