Executive Summary

This vulnerability exists in FOSSBilling versions 0.7.2 and prior, where a guest API endpoint (/api/guest/staff/create) meant for initial administrator setup remains accessible even after an administrator account has been created.

The issue arises because the check to see if an administrator already exists is flawed. It uses the is_countable() function on a value that returns either a Model_Admin object or null, which is not countable. This causes the check to always evaluate as true, bypassing the intended protection.

As a result, an attacker can access this unprotected endpoint to create a new administrator account and immediately authenticate, gaining full administrative privileges even when an admin already exists.

This vulnerability was fixed in version 0.8.0.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can create a new administrator account without authorization.

This grants the attacker full administrative access to the FOSSBilling system, allowing them to manage billing and client data, potentially leading to unauthorized data access, modification, or deletion.

Such unauthorized access can compromise the integrity, confidentiality, and availability of the system and its data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade FOSSBilling to version 0.8.0 or later, where the issue has been fixed.

Avoid using versions 0.7.2 and prior, as they expose an unprotected guest API endpoint that allows creation of new administrator accounts even after an admin exists.

Useful 0 Not Useful 0