Executive Summary

This vulnerability exists in the Plane open-source project management tool, specifically in versions 1.3.0 and below. It involves the SavedAnalyticEndpoint passing a user-controlled 'segment' query parameter directly into a Django F() expression without validation. Unlike the regular AnalyticsEndpoint, which uses an allowlist, this lack of validation allows an authenticated workspace member to craft a request that exploits ORM Field Reference Injection.

By sending a specially crafted GET request to the saved-analytic-view endpoint with a malicious segment value, the attacker can traverse foreign-key relationships in the database (for example, accessing workspace owner password hashes) and retrieve sensitive data such as bcrypt password hashes, API tokens, and other users' email addresses. This data is returned directly in the JSON response. The issue was fixed in version 1.3.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of sensitive information including bcrypt password hashes, API tokens, and email addresses of related users. An authenticated workspace member exploiting this flaw can access confidential data that should normally be protected, potentially leading to unauthorized access, credential compromise, and further attacks on the system or its users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Plane to version 1.3.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated workspace member to extract sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses by exploiting an ORM Field Reference Injection flaw. Exposure of such sensitive personal and authentication data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive information.

Specifically, GDPR requires organizations to protect personal data against unauthorized access and breaches, while HIPAA mandates safeguarding protected health information. The leakage of password hashes, API tokens, and email addresses through this vulnerability could be considered a data breach under these regulations, potentially resulting in legal and financial consequences.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious API requests to the SavedAnalyticEndpoint that include unusual or crafted values in the `segment` query parameter. Specifically, look for GET requests to the endpoint pattern `/api/workspaces/<slug>/saved-analytic-view/<analytic_id>/` where the `segment` parameter contains foreign-key traversal strings such as `workspace__owner__password` or other nested model field references.

To detect exploitation attempts on your system, you can use network or application logs to search for such crafted requests.

Example commands to detect suspicious requests in logs might include:

• Using grep on server access logs to find suspicious segment parameters: `grep -E 'segment=.*__' /path/to/access.log`
• Using curl to test if your system is vulnerable by sending a crafted request (requires authentication as a workspace member):
• curl -G -u <user>:<password> 'https://<your-plane-instance>/api/workspaces/<slug>/saved-analytic-view/<analytic_id>/' --data-urlencode 'segment=workspace__owner__password'

If the response contains sensitive data such as password hashes or email addresses, the system is vulnerable.

Useful 0 Not Useful 0