Unauthorized Data Access in FOSSBilling Due to Missing Email Verification

Executive Summary

This vulnerability affects FOSSBilling versions 0.5.6 through 0.7.2 when the "Require Email Confirmation" setting is enabled. A logged-in client whose email address is unverified (email_approved = 0) can access all client-area pages, such as balance, order list, and invoice pages, and view real account data including wallet balances and transaction history. Although the API restricts unverified clients to profile-related endpoints, the web page enforcement is too permissive and allows access to any URL path starting with /client.

This means that unverified users can see sensitive account information they should not have access to. The issue was fixed in version 0.8.0, and no known workarounds exist without modifying the source code.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if a logged-in client with an unverified email address (email_approved = 0) is able to access client-area pages that should be restricted, such as /client/balance, /client/order/list, and /client/invoice.

To detect exploitation attempts on your network or system, you can monitor HTTP requests to paths starting with /client from users whose email addresses are unverified.

Suggested commands include using tools like curl or wget to simulate requests as an unverified user, or using network monitoring tools like tcpdump or Wireshark to capture and analyze traffic for unauthorized access patterns.

• Use curl to test access to restricted pages: curl -b cookies.txt https://your-fossbilling-site/client/balance
• Use tcpdump to capture HTTP traffic on port 80 or 443: tcpdump -i eth0 -A 'tcp port 80 or tcp port 443'
• Use grep or similar tools to search server logs for requests to /client paths by unverified users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive client information such as wallet balances and transaction history to users who have not verified their email addresses. This could result in privacy breaches, loss of trust, and potential misuse of exposed financial data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unverified clients to access sensitive personal and financial data such as wallet balances, transaction history, invoices, orders, support tickets, and service management details without proper email verification.

Such unauthorized access to personal and financial information could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict access controls and verification mechanisms to protect user data privacy and security.

Because the system's stated policy requires email verification before accessing services but the enforcement is flawed, this discrepancy may result in violations of regulatory requirements for safeguarding sensitive client data.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability exists in FOSSBilling versions 0.5.6 through 0.7.2 when the "Require Email Confirmation" setting is enabled. The issue allows logged-in clients with unverified email addresses to access client-area pages and read sensitive account data.

The immediate mitigation step is to upgrade FOSSBilling to version 0.8.0 or later, which contains a fix for this vulnerability.

No known workarounds exist that do not involve modifying the source code.

Useful 0 Not Useful 0