Executive Summary

This vulnerability is a Missing Authorization issue in the server management routes of Azuriom CMS versions before 1.2.11. It allows an authenticated attacker who already has the admin.access permission to create AzLink server tokens and take over non-admin user accounts. The attacker can do this by sending crafted HTTP requests to specific endpoints such as /admin/servers/create and AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}), enabling them to change passwords and email addresses of other users without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is significant because it allows an attacker with limited admin permissions to escalate their control by taking over non-admin user accounts. This can lead to unauthorized access to user accounts, potential data breaches, and loss of trust in the system. The attacker can change critical user information such as passwords and email addresses, effectively locking out legitimate users and potentially causing disruption or misuse of the platform.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Azuriom CMS to version 1.2.11 or later, where missing permissions and authorization issues have been fixed.

Ensure that the new permission 'admin.servers' is properly configured to restrict access to server management routes.

Review and update your role permissions to prevent unauthorized users from accessing sensitive server management endpoints.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated attacker with admin.access permission to take over non-admin user accounts by changing their passwords and email addresses without proper authorization.

This unauthorized access and modification of user account information could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls over personal data access and modification.

Specifically, the ability to change email addresses and passwords of users without proper authorization undermines user data integrity and confidentiality, potentially resulting in non-compliance with standards that mandate protecting user identity and personal information.

Useful 0 Not Useful 0