Guest Admin Creation Bypass in FOSSBilling

Detection Guidance

This vulnerability can be detected by checking if the vulnerable guest API endpoint /api/guest/staff/create is accessible on your FOSSBilling installation, especially if the version is 0.7.2 or earlier.

You can attempt to detect the vulnerability by sending an unauthenticated HTTP request to the endpoint and observing if it allows creation of a new administrator account.

A simple command using curl to test accessibility of the endpoint might be:

• curl -X POST https://your-fossbilling-domain/api/guest/staff/create -d '{"username":"testadmin","password":"TestPass123!"}' -H 'Content-Type: application/json' -v

If the endpoint responds positively and allows creation of a new admin account without prior authentication, the system is vulnerable.

Additionally, you can check the version of FOSSBilling installed; versions 0.7.2 and earlier are vulnerable, while version 0.8.0 and later include the fix.

As a temporary mitigation, blocking or restricting access to the /api/guest/staff/create endpoint at the web server or firewall level can help prevent exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to create a new administrator account and gain full privileged access to the system. This unauthorized access could lead to exposure or manipulation of sensitive client and billing data managed by FOSSBilling.

Such unauthorized administrative access can compromise the confidentiality, integrity, and availability of personal and financial data, potentially violating data protection regulations such as GDPR and HIPAA that require strict access controls and protection of sensitive information.

Therefore, this vulnerability negatively impacts compliance with common standards and regulations by undermining the security controls necessary to protect sensitive data.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in FOSSBilling versions 0.7.2 and prior, where a guest API endpoint (/api/guest/staff/create) meant for initial administrator setup remains accessible even after an administrator account has been created.

The issue arises because the check to see if an administrator already exists is flawed. It uses the is_countable() function on a value that returns either a Model_Admin object or null, which is not countable. This causes the check to always evaluate as true, bypassing the intended protection.

As a result, an attacker can access this unprotected endpoint to create a new administrator account and immediately authenticate, gaining full administrative privileges even when an admin already exists.

This vulnerability was fixed in version 0.8.0.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can create a new administrator account without authorization.

This grants the attacker full administrative access to the FOSSBilling system, allowing them to manage billing and client data, potentially leading to unauthorized data access, modification, or deletion.

Such unauthorized access can compromise the integrity, confidentiality, and availability of the system and its data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade FOSSBilling to version 0.8.0 or later, where the issue has been fixed.

Avoid using versions 0.7.2 and prior, as they expose an unprotected guest API endpoint that allows creation of new administrator accounts even after an admin exists.

Useful 0 Not Useful 0