Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in OpenProject versions prior to 17.3.3 and 17.4.1. A project administrator in one project can exploit this by sending a specially crafted PATCH request to modify the "storages_project_storage[project_folder_id]" parameter. This causes the attacker to hijack the managed Nextcloud or OneDrive folder of another project on the same storage.

During the next synchronization, the Access Control List (ACL) on the victim's folder is overwritten with the attacker project's user list, granting unauthorized access to the victim's folder resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a critical impact by allowing an attacker with project-admin privileges in one project to gain unauthorized access to another project's managed storage folders (Nextcloud or OneDrive).

The attacker can overwrite the Access Control List (ACL) on the victim's folder, potentially exposing sensitive data, modifying or deleting files, and disrupting availability.

The CVSS score of 9.9 indicates a high severity with significant impact on confidentiality, integrity, and availability of data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious PATCH requests to the endpoint /projects/<A>/settings/project_storages/<A_ps_id> that modify the parameter "storages_project_storage[project_folder_id]".

Specifically, look for requests where a project administrator attempts to change the project_folder_id to one that does not belong to their project, which could indicate an attempt to hijack another project's managed folder.

Network or application logs can be searched for such PATCH requests. For example, using command-line tools like grep on server logs:

• grep -i 'PATCH /projects/' /var/log/openproject/access.log | grep 'storages_project_storage[project_folder_id]'
• Use web application firewall (WAF) rules to detect and alert on PATCH requests modifying project_folder_id parameters across projects.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade OpenProject to version 17.3.3 or 17.4.1 or later, where this vulnerability is fixed.

Until the upgrade can be performed, restrict PATCH access to the /projects/<A>/settings/project_storages/<A_ps_id> endpoint to trusted project administrators only and monitor for suspicious activity.

Additionally, review and audit the Access Control Lists (ACLs) on managed Nextcloud or OneDrive folders to ensure no unauthorized changes have been made.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a project administrator to gain unauthorized access to another project's managed Nextcloud or OneDrive folder by overwriting access control lists. Such unauthorized access can lead to exposure or modification of sensitive data.

Because the vulnerability impacts confidentiality, integrity, and availability of data with a critical severity (CVSS 9.9), it poses a significant risk to compliance with data protection regulations such as GDPR and HIPAA, which require strict controls on unauthorized data access and protection of personal or sensitive information.

Useful 0 Not Useful 0