Authorization Bypass in Mettle SendPortal via Campaign Creation

Impact Analysis

This vulnerability can lead to unauthorized use of email services from other workspaces, allowing an attacker to send campaigns on behalf of another tenant. This breaks the isolation between tenants, potentially exposing sensitive information or enabling malicious campaigns to be sent without proper authorization.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a cross-tenant authorization bypass in the SendPortal application, specifically affecting the Campaign Creation Endpoint. It allows a user in one workspace to create and send campaigns that reference email services belonging to another workspace. The root cause is insufficient validation during campaign creation and dispatch, where the application only checks if the email service ID exists but does not verify if it belongs to the user's workspace. This breaks tenant isolation and enables unauthorized access to resources across different workspaces.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows cross-tenant authorization bypass, enabling users to access and use resources belonging to other workspaces without proper authorization.

Such unauthorized access and potential data leakage could lead to violations of data protection and privacy regulations like GDPR and HIPAA, which require strict access controls and tenant isolation to protect personal and sensitive information.

Therefore, the flaw undermines compliance with these standards by breaking tenant isolation and allowing unauthorized cross-workspace resource usage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a cross-tenant authorization bypass in the SendPortal application, specifically in the campaign creation and dispatch workflows where email service ownership is not properly validated.

To detect this vulnerability on your system, you should check if the application allows users to create or dispatch campaigns referencing email services that belong to other workspaces without proper ownership validation.

Since the issue is in the validation of email_service_id in CampaignStoreRequest.php and dispatch in ResolveEmailService.php, you can attempt to create or send campaigns using email_service_ids from other workspaces and observe if the system permits it.

There are no specific commands provided in the resources, but you can perform API or UI tests to verify if cross-workspace resource usage is possible.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation involves enforcing strict validation to ensure that email services referenced during campaign creation and dispatch belong to the current user's workspace.

Specifically, add workspace scoping to the email service validation rules in the CampaignStoreRequest.php file and enforce ownership validation during the dispatch process in ResolveEmailService.php.

Until an official patch or update is released, restrict user permissions to limit campaign creation and dispatch capabilities or monitor for suspicious cross-workspace activity.

Useful 0 Not Useful 0