Unauthenticated Mass Assignment in FOSSBilling Client Groups

Executive Summary

This vulnerability exists in FOSSBilling, an open-source billing and client management system, prior to version 0.8.0. It is an unauthenticated mass assignment vulnerability in the client self-registration endpoint. This means that any visitor, without needing to log in, can assign themselves to any client group they choose during the sign-up process.

Since client groups control access to promo codes, an attacker exploiting this vulnerability can apply group-restricted discount codes and receive unauthorized discounts.

The issue was fixed in version 0.8.0. As a temporary workaround, administrators can either remove group restrictions from promo codes or disable client self-registration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized users obtaining discounts they are not entitled to by assigning themselves to privileged client groups during registration.

This can result in financial losses due to misuse of promo codes and discounts.

Additionally, it may undermine the integrity of client group management and promotional campaigns.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, administrators should either remove group restrictions from promo codes or disable client self-registration.

Disabling client self-registration can be done via the application settings: Settings → Clients → Disable signup.

Alternatively, upgrading FOSSBilling to version 0.8.0 or later will apply the patch that fixes this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring or testing the guest client registration endpoint for unauthorized mass assignment of the group_id parameter.

Specifically, you can attempt to send a POST request to the endpoint /api/guest/client/create including a group_id parameter to see if the system accepts it without authentication.

For example, using curl to test the endpoint:

• curl -X POST https://your-fossbilling-instance/api/guest/client/create -d '{"group_id": "1", "other_required_fields": "values"}' -H 'Content-Type: application/json'

If the request succeeds and the client is assigned to the specified group_id without authentication, the system is vulnerable.

Additionally, monitoring network traffic for POST requests to /api/guest/client/create that include a group_id parameter can help detect exploitation attempts.

Useful 0 Not Useful 0