NULL-auth Bypass in Capgo Exposes RBAC Data

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 and involves a NULL-auth bypass in the public.get_org_user_access_rbac function.

It allows unauthenticated attackers to retrieve Role-Based Access Control (RBAC) role bindings and member email addresses.

The issue arises from an improper NULL comparison in the authorization gate, which can be exploited via the PostgREST RPC endpoint using only a public API key.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the public.get_org_user_access_rbac function via the PostgREST RPC endpoint using only a public API key without authentication.

If the request returns RBAC role bindings and member email addresses without requiring authentication, it indicates the presence of the NULL-auth bypass vulnerability.

A suggested command to test this could be a curl request like the following:

• curl -H "apikey: <public_api_key>" https://<capgo_instance>/rpc/get_org_user_access_rbac

If the response includes sensitive RBAC and email information without authentication, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can disclose sensitive information such as organization membership details, roles assigned to users, and their email addresses without any authentication.

This can lead to unauthorized information disclosure, potentially enabling further targeted attacks like phishing or social engineering.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to retrieve RBAC role bindings and member email addresses, which could lead to unauthorized disclosure of personal and organizational information.

Such unauthorized disclosure of email addresses and role information may impact compliance with data protection regulations like GDPR and HIPAA, which require protection of personal data and access controls.

However, specific impacts on compliance or regulatory requirements are not detailed in the provided information.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Capgo to version 12.128.2 or later, where the vulnerability has been patched.

The patch fixes the improper NULL comparison in the authorization gate, preventing unauthenticated access to RBAC role bindings and member email addresses.

Additionally, ensure that the authorization logic explicitly denies unauthenticated requests and uses NULL-safe comparisons.

Useful 0 Not Useful 0